Secure Decryption Key Management for Electronic Devices
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing public-key encryption algorithms, such as RSA and ECIES, face challenges in securely decrypting large data streams on electronic devices, as the symmetric key remains in memory during a locked state, allowing unauthorized access. Additionally, the process of generating and recovering secret keys for decryption is inefficient, especially with multiple decryption requests for the same data file.
Innovation Solution
The method employs a series of secret keys derived from a shared secret, where each key is used to encrypt a discrete portion of data and deleted after use, with a context key used to encrypt the current secret key, allowing for efficient recovery during an unlock state, reducing processing time and power consumption by regenerating the context key to decrypt subsequent segments.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If the symmetric key is held in memory during encryption and decryption operations, then encryption/decryption can be performed efficiently, but the key remains vulnerable to unauthorized access when the device is locked
Solution Approach 1:
The patent segments the secret key into multiple key shares and stores them in different secure locations (secure element, trusted execution environment, or secure memory regions). This segmentation allows the key to be reconstructed only when all shares are combined under authorized conditions, preventing unauthorized access during locked states while maintaining decryption capability when needed.
Solution Approach 2:
The patent performs preliminary key derivation and preparation during the unlock process before actual decryption operations begin. Key shares are retrieved and combined in advance, and the symmetric key is derived and stored in secure memory only after authentication succeeds, ensuring the key is available for efficient decryption operations while maintaining security during the locked state.
2Reliability
If secret keys are generated and deleted for each decryption request, then security is maintained, but processing time and power consumption increase significantly
Solution Approach 1:
The patent performs preliminary key derivation during the unlock process, where key shares are retrieved and combined to derive the symmetric key in advance. This preliminary action stores the derived key securely in memory, so that subsequent decryption operations can reuse the same key without regenerating it, significantly reducing processing time and power consumption for multiple decryption requests on the same encrypted data.
Solution Approach 2:
The patent implements a dynamic key management system where the symmetric key lifecycle is adjusted based on operational context. The key is derived and stored in secure memory during unlock state for efficient decryption operations, and automatically cleared when the device locks or memory is full. This dynamic approach balances security requirements with performance optimization.
3Reliability
If multiple key shares are stored in different secure locations, then security against unauthorized access is improved, but device complexity increases
Solution Approach 1:
The patent implements a universal key management interface that abstracts the complexity of multiple key shares and secure locations. The system provides a standardized API for key derivation, retrieval, and combination operations that works regardless of which secure storage mechanisms are used. This multi-functional approach allows the same key management logic to operate with different combinations of secure elements, trusted execution environments, and secure memory regions, reducing the apparent complexity for applications.
Solution Approach 2:
The patent introduces an intermediary key management layer that mediates between the application and the underlying secure storage mechanisms. This intermediary handles the complex operations of retrieving key shares from different secure locations, validating their authenticity, combining them securely, and deriving the symmetric key. By placing this intermediary layer, the patent isolates the complexity from both the application and the hardware, making the system more manageable and maintainable.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Systems, methods, and software can be used to encrypt and decrypt data. In some aspects, a decryption request to decrypt the encrypted data is received from an application on an electronic device. A first secret key from a shared secret is generated. The shared secret is generated based on a master private key and an ephemeral public key associated with the encrypted data. A first encrypted secret key is generated using the first secret key and a context key. The context key is generated based on the master private key. A first portion of the encrypted data is decrypted using the first secret key. A second secret key is generated from the first secret key. The first secret key is deleted. At least a segment of the decrypted first portion of the encrypted data is sent to the application.