Mode Sensitive Encryption Framework for Mobile Data Separation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional mobile device encryption mechanisms are limited to application-level encryption, failing to provide adequate mode separation and data protection, especially for external memory cards and network connections, leading to vulnerabilities in data and application separation models.
Innovation Solution
A framework-level mode sensitive encryption system that manages processes and resources at the operating system level, enabling different modes (e.g., work and personal) with secure file access, network routing, and encryption, allowing seamless operation without requiring hard partitioning of storage or disrupting user experience during mode switches.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If enterprise grade applications are downloaded and installed on mobile devices, then application-level encryption is provided, but data storage behavior is not affected creating vulnerabilities and gaps in data separation models
Solution Approach 1:
The patent divides the encryption architecture into multiple layers: application-level encryption (existing) and framework-level mode-sensitive encryption (new). The framework layer segments encryption control by operational modes (personal, work, enterprise), allowing different encryption policies for different data types without requiring complete architectural redesign. This resolves the contradiction by adding security at the framework level while preserving the existing application-level encryption structure.
Solution Approach 2:
The patent introduces a framework-level intermediary layer that sits between the operating system and applications. This intermediary implements mode-sensitive encryption policies, mediating between application data storage requests and the underlying file system. The intermediary ensures that data separation policies are enforced at the framework level without requiring changes to individual applications or the operating system core, thus improving security while maintaining system compatibility.
2Reliability
If framework-level mode sensitive encryption is implemented, then complete data separation between modes is achieved, but system complexity increases
Solution Approach 1:
The patent creates a universal framework-level encryption system that handles multiple encryption scenarios (personal, work, enterprise modes) through a single unified architecture. The mode-sensitive encryption framework provides multi-functional capabilities: it can encrypt individual files, entire folders, manage multiple operational modes, and enforce different security policies all through one system. This reduces overall complexity compared to implementing separate encryption systems for each mode or application.
Solution Approach 2:
The patent implements mode-sensitive encryption by changing encryption parameters (keys, policies, algorithms) based on the operational mode rather than requiring separate encryption systems. The framework dynamically adjusts encryption parameters according to the active mode, allowing the same underlying encryption mechanism to provide different security levels and policies for different data types. This parameter-based approach simplifies the system compared to having separate encryption implementations for each mode.
3Reliability
If mode switching is implemented at framework level, then data separation is enhanced, but user experience may be disrupted during mode switches
Solution Approach 1:
The patent implements preliminary action by pre-establishing mode-sensitive encryption policies and encryption keys for each operational mode before mode switching occurs. When a mode switch is triggered, the framework has already prepared the necessary encryption context and key material, allowing for seamless transition without requiring real-time key generation or policy negotiation. This preliminary preparation ensures that data separation is maintained while mode switching remains transparent to the user.
4Reliability
If application-level encryption is used, then encryption functionality is provided, but data storage behavior remains unaffected creating security gaps
Solution Approach 1:
The patent merges application-level encryption with framework-level mode-sensitive encryption into a unified security architecture. Rather than having encryption operate independently at the application level or requiring complete OS-level restructuring, the framework layer combines both approaches: it enforces mode-based encryption policies while allowing applications to maintain their existing encryption capabilities. This merging provides comprehensive encryption coverage across all data types while avoiding the complexity of completely replacing the existing encryption architecture.
Data Source
AI summary
Mechanisms are provided to implement framework level mode specific file access operations. In a mode such as a work or enterprise mode, read and write accesses are directed to one or more secured locations. File data and metadata may be secured with encryption and/or authentication mechanisms. Conventional mobile solutions provide only for mode encryption distinctions at the application level, e.g. one work application may prevent access to certain data, but a different application may want to allow access to that same data. Various embodiments provide framework level mode sensitive encryption that does not require different, mutually exclusive, or possibly conflicting applications or platforms. A device and associated applications may have access to different data based on a current mode.