Mobile App Encryption on Removable Storage via Namespace Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Mobile devices face challenges in protecting intellectual property and ensuring application isolation due to removable storage capabilities, as secure digital cards lack advanced security features and can be easily read by personal computers, allowing unauthorized copying and interference between applications.
Innovation Solution
Applications are stored on removable storage in encrypted form using unique encryption keys generated based on identifiers and a master key associated with the trusted platform module, with each folder or directory associated with a content item encrypted separately to prevent unauthorized access and ensure isolation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If content items are stored on removable storage (secure digital cards), then storage capacity and flexibility are improved, but security and intellectual property protection deteriorate
Solution Approach 1:
The patent divides the removable storage into multiple isolated namespaces, each dedicated to a specific application. Each namespace contains only the files and resources that application can access, preventing other applications from accessing or copying their content. This segmentation maintains the flexibility of removable storage while eliminating the security vulnerability of unauthorized access.
Solution Approach 2:
The patent implements different security characteristics for different regions of the storage medium. Each application's namespace has its own access control permissions, encryption keys, and isolation boundaries. This local quality approach allows the system to provide high security for each application's data while maintaining overall storage flexibility.
2Reliability
If applications are stored in isolation on internal storage, then security and application isolation are improved, but storage flexibility and expandability deteriorate
Solution Approach 1:
The patent creates isolated namespaces for each application within the removable storage, replicating the security model of internal storage. Each namespace acts as an independent container with its own access controls, maintaining application isolation while allowing the storage to be removable and expandable.
3Ease of operation
If secure digital cards use FAT or exFAT file systems, then compatibility and ease of operation are improved, but application isolation and security functionality deteriorate
Solution Approach 1:
The patent introduces a namespace management layer that sits between the FAT/exFAT file system and the applications. This intermediary translates standard file system operations into namespace-aware operations, enabling applications to access only their designated files while maintaining compatibility with FAT/exFAT formats for broad device support.
4Ease of operation
If users can copy content from removable storage to personal computers, then ease of data transfer is improved, but intellectual property protection and anti-piracy deteriorate
Solution Approach 1:
The patent segments application data into isolated namespaces that are inaccessible to the general file system. Even when removable storage is connected to a personal computer, the namespace isolation prevents copying of application files, as the file system cannot access files outside the authorized namespace without proper authentication tokens.
Solution Approach 2:
The patent implements preliminary protective measures by encrypting application files and storing encryption keys within the isolated namespace. This preliminary anti-action prevents piracy before it can occur, as the content remains encrypted and inaccessible without the namespace-specific decryption keys that only the authorized application possesses.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Applications are stored on removable storage of a mobile device in an encrypted form to provide isolation and piracy protection. In one implementation, each application is encrypted using its own associated encryption key that is generated based on an identifier of the application and a master key that is associated with a trusted platform module of the mobile device. In another implementation, each application is encrypted using two associated encryption keys. One key is used to encrypt binary data associated with the application such as source code, and the other key is used to encrypt application data such as graphics and configuration files. The encryption keys are each generated using the identifier of the application, the master key, and identifiers of the folders where the corresponding data types are stored on the mobile device. The removable storage includes SD cards formatted using the FAT or exFAT file systems.