Mobile Cryptography Key Management via UID and UDID Binding
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional cryptography solutions for mobile devices are inadequate in ensuring data security and integrity due to limited computing power, vulnerability to theft, and lack of control over access and location, as they often rely on public key infrastructure and manual intervention, which are not cost-effective or scalable for large deployments.
Innovation Solution
A method using a unique user identifier (UID), unique device identifier (UDID), and password to obtain a cryptography key for encryption/decryption, which binds decryption keys to a specific device and user, ensuring secure data access and recovery while addressing computational limitations and administrative needs.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If public key infrastructure (PKI) is used for mobile device encryption, then data security is improved, but computational cost and processing requirements increase significantly
Solution Approach 1:
The system segments the encryption architecture into two parts: asymmetric key exchange for secure key distribution and symmetric key encryption for actual data encryption. This segmentation allows mobile devices to use computationally inexpensive symmetric encryption for data while relying on the server for asymmetric key operations, resolving the contradiction between security and computational cost.
Solution Approach 2:
The invention introduces a key distribution server as an intermediary that handles the computationally intensive asymmetric key operations. The server acts as a mediator between users and the encryption system, performing certificate verification and key generation while mobile devices only need to perform lightweight symmetric encryption, thus reducing their computational burden while maintaining security.
2Reliability
If multiple encryption keys are used for different data pieces, then data security is improved, but key management complexity increases
Solution Approach 1:
The system implements a universal key management server that handles multiple functions: key generation, key distribution, key rotation, and key recovery for all encrypted data pieces. This centralized multi-functional approach eliminates the need for users to manually manage multiple keys, as the server automatically handles all key lifecycle operations, thus maintaining security while reducing management complexity.
Solution Approach 2:
The key management system provides self-service capabilities where the server automatically generates, distributes, and rotates encryption keys without requiring manual user intervention. The system autonomously manages the entire key lifecycle, including automatic key recovery mechanisms, which simplifies key management while maintaining robust security through multiple encrypted keys.
3Reliability
If encryption keys are changed periodically, then data security is improved, but data recovery difficulty increases
Solution Approach 1:
The system performs preliminary actions by establishing key escrow mechanisms before key changes occur. The key management server maintains secure copies of encryption keys in escrow, and automatically manages key rotation while preserving the ability to recover data. This preliminary preparation ensures that when keys are changed periodically for security, data recovery remains easy through the pre-established escrow system.
Solution Approach 2:
The key management system implements feedback mechanisms that automatically trigger key rotation based on security policies while maintaining recovery capabilities. The server monitors encryption key usage and automatically initiates key changes, then provides feedback to ensure data can still be recovered through the escrow system, thus maintaining both security through periodic changes and ease of recovery through automated management.
4Reliability
If conventional key escrow solutions are used for fixed systems, then data security is improved, but adaptability to mobile devices decreases
Solution Approach 1:
The system implements local quality by tailoring the encryption approach to mobile device constraints. While the overall architecture follows conventional key escrow principles for security, the mobile-specific implementation uses lightweight symmetric encryption locally on devices, reserves asymmetric operations for the server, and optimizes key storage for mobile hardware limitations, thus adapting conventional solutions to mobile environments.
Solution Approach 2:
The invention changes key parameters to suit mobile devices: using shorter key lengths appropriate for mobile computational capabilities, implementing optimized key storage formats for mobile hardware, and adjusting encryption algorithms to balance security with mobile device power consumption and processing constraints, thereby making conventional key escrow adaptable to mobile platforms.
Data Source
AI summary
A technique for obtaining a key for encryption/decryption/data recovery from an enterprise key management system. In one example embodiment, this is accomplished by connecting a client mobile device to a cryptography key management using a UID, a UDID, the names of one or more data files to encrypt, a password Pswd, and a KeyID to obtain the key for encryption/decryption/data recovery.