Device-Based PIN Authentication for Encrypted Mobile Data
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing security mechanisms for accessing encrypted data on mobile devices are inconvenient due to the need for complex passwords, which can be cumbersome to enter and are susceptible to brute force attacks, while simple passwords offer inadequate security.
Innovation Solution
A device-based PIN authentication process that uses a PIN as part of a secure cryptographic process to access encrypted data, where the PIN is used to generate encryption keys and split key data between the client and server, providing secure access without the need for frequent complex password entry.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a complex password is used to protect encrypted data, then security is improved, but ease of operation deteriorates
Solution Approach 1:
The authentication system is segmented into two independent components: a complex password stored securely on the server and a simple PIN entered by the user. The password is never transmitted or entered by the user, while the PIN serves as a convenient reference to retrieve the password from the server. This segmentation allows each component to be optimized independently for its specific function.
Solution Approach 2:
The server acts as an intermediary that holds the complex password and uses the simple PIN as a key to retrieve it. The PIN itself does not provide security directly; instead, it mediates access to the actual authentication credential (the password) stored on the server. This intermediary approach allows the user to interact with a simple interface while the system maintains strong security.
2Reliability
If a complex password is required for each application access, then security is improved, but loss of time increases
Solution Approach 1:
The complex password is preliminarily established and stored on the server during initial setup. This preparation eliminates the need for the user to create or remember multiple complex passwords for different applications. The server is pre-configured with the password, and the PIN serves as a quick reference key to retrieve it, dramatically reducing access time while maintaining security.
3Ease of operation
If simple password rules are used, then ease of operation is improved, but security deteriorates
Solution Approach 1:
Instead of using the simple PIN directly for authentication, the system creates a cryptographic copy or derivative of the PIN (through key derivation functions) to generate the actual authentication credentials. The PIN itself remains simple and easy to enter, but its cryptographic transformation ensures strong security properties. This copying approach allows the simple input to yield secure output without exposing the weak link.
Data Source
AI summary
Techniques are disclosed for providing a device-based PIN authentication process used to protect encrypted data stored on a computing system, such as a tablet or mobile device. A client component and a server component each store distinct cryptographic keys needed to access encrypted data on the client. The mobile device stores a vault encryption key used to decrypt encrypted sensitive data stored on the mobile device. The vault key is encrypted using a first encryption key and stored on the mobile device. The first encryption key is itself encrypted using a second encryption key. The second encryption key is derived from the PIN value.