Remote Keychain for Mobile Devices Using Token-Based Credential Storage
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Mobile devices pose security risks when accessing enterprise assets due to the storage of corporate credentials, which can be exposed if the device is lost or stolen, and existing solutions like Apple's keychain do not adequately address these issues, leading to potential password exposure and transcription errors.
Innovation Solution
Implementing a method to remotely store and manage keychains on a mobile device, using a device token and asset token to securely access remote assets without storing credentials locally, allowing for secure sharing and auditing of secret usage.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If corporate credentials are stored on a mobile device for access to enterprise assets, then ease of operation is improved, but security is worsened due to risk of exposure if device is lost or stolen
Solution Approach 1:
The patent extracts the actual credentials (passwords, secrets) from the mobile device and stores them on a remote server instead. The device only holds references or tokens that point to the credentials, not the credentials themselves. This resolves the contradiction by maintaining ease of access through local references while eliminating security risks by removing sensitive data from the device.
Solution Approach 2:
The patent introduces a remote server as an intermediary between the mobile device and enterprise assets. The server acts as a secure vault that stores credentials and provides them to the device when needed through authenticated requests. This mediator enables secure credential management by centralizing storage while maintaining distributed access capability.
2Ease of operation
If credentials are stored in a local keychain on the mobile device, then ease of operation is improved, but loss of information is worsened when device is lost as credentials cannot be remotely revoked
Solution Approach 1:
The patent implements a feedback mechanism where the mobile device periodically checks with the remote server to determine if its credentials have been revoked or updated. The server can push revocation status back to the device, ensuring that lost or compromised credentials are invalidated remotely. This resolves the contradiction by maintaining local storage convenience while enabling remote control over credential validity.
3Ease of operation
If credentials are sent from mobile device to backend service over network, then ease of operation is improved, but security is worsened due to network transmission risks
Solution Approach 1:
The patent creates a reference copy or token that represents the actual credential. Instead of transmitting the real password or secret over the network, the device sends this reference token to the backend service. The backend service then uses the token to retrieve the actual credential from the secure remote storage. This resolves the contradiction by enabling necessary network communication while eliminating the risk of exposing actual credentials during transmission.
Data Source
AI summary
An app of a mobile device registers the mobile device for a remote credential server (RCS) and receives a device token. When a credential for a remote asset is supplied on the mobile device it is routed to the RCS and stored external to the mobile device but referenced on the mobile device via an asset token. When the credential is needed, the device token and the asset token permit the RCS to authenticate and return the credential to or on behalf of the mobile device so that the mobile device can authenticate to and access the remote asset.