Mobile Device Secret Data Protection via Key Splitting
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional systems for protecting secret data on mobile devices are only as secure as the user's master password, making them vulnerable to unauthorized access due to weak password usability.
Innovation Solution
A method involving the random generation of a strong encryption key and its splitting into shares, where one share is fixed based on the user's password or specific data, requiring the combination of multiple shares to unlock the key, ensuring that no information about the key is leaked unless properly unlocked.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If a master user password is used to protect secret data, then the system is easy to operate, but the security strength is limited by the password strength
Solution Approach 1:
The encryption key is segmented into multiple shares using secret splitting technique. The first share is derived from user-specific data (password) and stored locally, while the second share is generated randomly and stored securely. Both shares are needed to reconstruct the encryption key, so even if the password is weak, the random second share provides additional security entropy.
Solution Approach 2:
A secret splitting algorithm acts as an intermediary between the user password and the encryption key. Instead of directly using the password to protect data, the system uses the password to generate one share of the key, which then combines with another share through the secret splitting mechanism to produce the final encryption key.
2Reliability
If a strong encryption key is generated randomly, then the security strength is improved, but the system becomes more complex
Solution Approach 1:
The strong encryption key is segmented into shares using secret splitting. One share is fixed based on user-specific data and stored locally on the mobile device, while another share is generated and stored securely. This segmentation allows the system to use a strong randomly generated key while managing complexity through distributed storage and reconstruction.
Solution Approach 2:
The mobile device itself performs the secret splitting and key reconstruction operations locally. The device uses its own processor to combine the stored first share with the generated second share to recreate the encryption key, eliminating the need for external key management infrastructure.
Data Source
AI summary
A method includes (1) receiving, by a mobile computing device (MCD), user-specific data from a user, (2) processing (a) a user share of a cryptographic key, the user share being fixed based on the received user-specified data, and (b) a local share of the cryptographic key to recreate the cryptographic key, wherein the local share was created by applying a secret splitting algorithm to the cryptographic key and the user share to yield a set of non-fixed shares including the local share, the user share and the set of non-fixed shares making up a set of shares of the cryptographic key, the cryptographic key being recreatable from a strict subset of the set of shares, and (3) decrypting encrypted data stored on the MCD using the recreated cryptographic key, thereby providing access, using the decrypted encrypted data, to the resource.