Secure Circuit Key Bag Isolation for Multi-User Data
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Computing devices face challenges in securely isolating data for multiple users, as existing encryption methods often use a single key that can be misused by authorized users to access others' data, and unencrypted data can be accessed by malicious individuals even if they don't have login credentials.
Innovation Solution
Implementing cryptographic isolation through a secure circuit that maintains key bags for each user, where each key bag is encrypted with a master key derived from the user's credential, preventing access to other users' data without their credentials, and using data keys to encrypt and decrypt user data with a memory controller.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If a single encryption key is used for all users, then device complexity is reduced, but security is compromised as authorized users can access other users' data
Solution Approach 1:
The patent divides the single encryption key into multiple user-specific key bags, where each key bag contains encryption keys for a specific user. This segmentation allows each user to have isolated access to their own data while preventing access to other users' data, thus improving security without significantly increasing overall system complexity.
Solution Approach 2:
The patent introduces a hierarchical dimension to key management by wrapping user-specific key bags with a master key derived from user credentials. This creates a two-layer structure (master key layer and user-specific key layer) that enables fine-grained access control while maintaining manageable complexity.
2Ease of operation
If data is stored unencrypted, then ease of operation is improved, but security is compromised as malicious persons can extract data directly from memory
Solution Approach 1:
The patent applies encryption to data before it is stored in memory, as a preliminary protective action. The data is encrypted using user-specific keys from key bags, so that even if malicious persons extract data from memory, they cannot access the actual information without the corresponding decryption keys.
3Reliability
If user credentials are required for access, then security is improved, but ease of operation is reduced due to additional authentication steps
Solution Approach 1:
The system automatically derives the master key from the user's credentials and uses it to unwrap the appropriate key bag without requiring manual intervention. This self-service mechanism maintains strong access control while minimizing the operational burden on users.
Data Source
AI summary
Techniques are disclosed relating to securely storing data in a computing device. In one embodiment, a computing device includes a secure circuit configured to maintain key bags for a plurality of users, each associated with a respective one of the plurality of users and including a first set of keys usable to decrypt a second set of encrypted keys for decrypting data associated with the respective user. The secure circuit is configured to receive an indication that an encrypted file of a first of the plurality of users is to be accessed and use a key in a key bag associated with the first user to decrypt an encrypted key of the second set of encrypted keys. The secure circuit is further configured to convey the decrypted key to a memory controller configured to decrypt the encrypted file upon retrieval from a memory.