Mobile Data Vault Encryption Key Derivation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current security measures for mobile devices, such as the iPad and iPhone, are inadequate as they rely on weak device passcodes and hardware encryption that can be easily brute-forced, and are vulnerable to decryption if the user's computer is compromised, necessitating enhanced data protection.
Innovation Solution
The implementation of a software-based encryption system, CommandHub Mobile Vault, which uses a strong password-protected encryption processor with AES-256 encryption, generating a complex encryption key from the user password, device ID, and a hard-coded salt, processed through a hash-based message authentication code, to securely store and manage data independently of the operating system.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If hardware encryption with device passcode is used, then data protection is provided, but the security is inadequate and can be brute-forced
Solution Approach 1:
The patent changes the encryption parameter from hardware-based AES encryption with simple passcodes to software-based custom encryption with complex key derivation. The encryption key is generated by combining the user password with a unique device identifier and salt through a hash-based message authentication code, creating a much stronger cryptographic parameter that resists brute-force attacks.
Solution Approach 2:
The patent introduces a software-based encryption processor as an intermediary between the user password and the encrypted data. This intermediary component derives a unique encryption key from the password using cryptographic hash functions and message authentication codes, providing an additional layer of security that hardware encryption alone cannot achieve.
2Reliability
If full disk encryption is used, then data is protected, but the encryption keys can be compromised if the user's computer is obtained
Solution Approach 1:
The patent extracts the encryption key generation process from the device's hardware encryption system and implements it independently through a software-based encryption processor. The encryption key is derived locally from the user password and device identifier without being stored or escrowed anywhere, eliminating the vulnerability where keys could be accessed if the user's computer is compromised.
Solution Approach 2:
The encryption system provides self-service security by generating and using encryption keys that are uniquely derived from the user's own password and device identifier. The system does not rely on external key management or escrow mechanisms, making it immune to key compromise through device recovery or computer access.
3Object-affected harmful factors
If strong encryption keys are used, then security against brute-force attacks is improved, but the complexity of the encryption system increases
Solution Approach 1:
The patent implements a universal encryption approach where a single software-based encryption processor handles all encryption operations for the application. This multi-functional component performs key derivation, data encryption, and key management tasks, simplifying the overall system architecture while maintaining strong security through standardized cryptographic operations.
Data Source
AI summary
A portable electronic device is provided. The portable electronic device includes a data interface module that processes files associated with a user, the data interface module receives and validates a password from a user of the portable electronic device before the user is allowed access to files processed by the data interface module, an encryption key formed by the data interface module upon validation of the password, the encryption key further comprising the password, a hard coded private string and a serial number of the portable electronic device and a data storage area that stores files received from the data interface module the stored files are encrypted using the encryption key and where neither the encryption key or the password are stored in an unencrypted format anyplace within the portable electronic device.