Multi-Tier Encryption for Secret Data in Secure Elements
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional password managers are vulnerable to attacks due to exposure of multiple attack surfaces, including shared passwords, insecure input systems, and storage of encrypted databases on devices, which can be hacked or decrypted by malicious entities.
Innovation Solution
A system and method using multiple layers of encryption, multiple encryption keys, and a secure microprocessor (such as a Secure Element) to protect secret data items, where a hardware encryption key is generated to encrypt and decrypt data, with additional layers of encryption and a key derivation function to enhance security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If conventional password managers store encrypted databases on device storage, then data accessibility is improved, but security is worsened due to vulnerability to hacking and decryption attacks
Solution Approach 1:
The patent extracts the encryption key generation and storage functions from the main password manager software and relocates them to a dedicated secure element hardware component. This separation ensures that even if the software is compromised, the encryption keys remain protected in the isolated hardware environment, resolving the contradiction between accessibility and security.
Solution Approach 2:
The patent introduces a secure element as an intermediary hardware component between the password manager software and the encrypted database. This intermediary handles all encryption/decryption operations and key management, preventing direct access to sensitive data by malicious software while maintaining user accessibility through the normal interface.
2Reliability
If multiple encryption layers and secure element are used, then security is improved, but device complexity is worsened
Solution Approach 1:
The patent segments the password manager system into distinct functional modules: a password manager application layer for user interaction, a secure element hardware layer for key generation and encryption operations, and a database layer for storing encrypted data. This segmentation allows each component to be optimized independently while working together to provide robust security without overwhelming complexity.
Solution Approach 2:
The secure element performs self-service functions by autonomously generating encryption keys, managing key lifecycles, and executing encryption/decryption operations without requiring external intervention. This self-contained approach enhances security while simplifying the overall system architecture by eliminating the need for complex key management protocols in the software layer.
Data Source
AI summary
A system and method for protecting secret data items using multiple layers of encryption with multiple encryption keys, a Secure Element, and a sandbox on an electronic device includes a secret data item manager. The secret data item manager encrypts secret data items using a hardware encryption key and the Secure Element. It encrypts the transient secret cipher data with an account encryption key to generate and store repository account cipher data. It further encrypts the account encryption key to generate and store the repository account key cipher data with a root encryption key. The manager also derives a secondary encryption key from a user account password, encrypts the root encryption key with the secondary key to generate the transient root encryption key, encrypts the transient root encryption key using the hardware key to generate the repository root encryption key cipher data, and stores repository root encryption key cipher data.