Processor-Based Data Protection for Mobile Devices
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Mobile computing devices face challenges in data security due to their mobility and limited processing power, making existing software-based encryption solutions inadequate for protecting sensitive data from loss or theft.
Innovation Solution
A processor-based data protection system that utilizes a central processing unit with a cryptographic engine to securely encrypt and decrypt data using a cryptographic key, which is not exposed to applications or other devices, providing improved security and faster encryption/decryption processes compared to software-based methods.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If software-based data encryption/decryption is used on mobile devices, then data protection is provided, but the computational power required exceeds what mobile processors can deliver
Solution Approach 1:
The patent extracts the cryptographic key management and encryption/decryption operations from the general software layer and places them in a dedicated hardware cryptographic engine within the processor. This separates the computationally intensive security functions from the main processor software stack, providing robust data protection while minimizing the computational burden on the mobile device's limited processing power.
Solution Approach 2:
The patent introduces a hardware cryptographic engine as an intermediary component between the storage system and the application layer. This cryptographic engine acts as a mediator that handles all encryption and decryption operations, protecting data at rest without requiring the main processor to perform heavy computational tasks. The cryptographic engine receives plaintext data, encrypts it using hardware-managed keys, and stores the ciphertext, thereby providing strong data protection while preserving the limited computational resources of mobile devices.
2Reliability
If self-encrypting hard disk drives are used, then data encryption is provided, but the form factor restricts their use in mobile devices
Solution Approach 1:
The patent merges the cryptographic engine directly into the processor chip, combining the functions of data processing and cryptographic operations into a single integrated unit. This integration eliminates the need for separate self-encrypting drive components, providing data encryption capability while maintaining the compact form factor required for mobile devices. The cryptographic engine shares the processor's substrate and power resources, achieving space efficiency without sacrificing security functionality.
3Reliability
If cryptographic keys are stored in software on mobile devices, then data encryption is enabled, but the keys are exposed to applications and other devices
Solution Approach 1:
The patent extracts cryptographic key storage and management from the software layer and places it in a protected hardware environment within the processor. The cryptographic engine maintains keys in secure registers and memory areas that are inaccessible to the operating system and applications. This hardware-based key management extracts the security-critical functions from the vulnerable software environment, preventing key exposure while enabling robust data encryption.
Solution Approach 2:
The hardware cryptographic engine serves as an intermediary that handles all cryptographic operations using protected keys. The engine receives data for encryption, applies the hardware-secured keys through cryptographic algorithms, and returns the encrypted result without ever exposing the keys to the software layer or applications. This intermediary architecture provides a secure boundary that protects sensitive key material while enabling encryption functionality.
Data Source
AI summary
A device, system, and method for providing processor-based data protection on a mobile computing device includes accessing data stored in memory with a central processing unit of the mobile computing device and determining that the accessed data is encrypted data based on a data included in one or more control registers of the central processing unit. If the data is determined to be encrypted data, the central processing unit is to decrypt the encrypted data using a cryptographic key stored in the central processing unit. The encrypted data may also be stored on a drive of the mobile computing device. The encryption state of the data stored on the drive is maintained in a drive encryption table, which is used to update a memory page tables and the one or more control registers.