Multi-User Secure Element Access via Isolated CRS Applets
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing mobile devices and smart cards do not allow secure storage and access of confidential information for multiple users, lacking protection to ensure that each user can only access their own information.
Innovation Solution
A computing device with a secure element configured to store confidential information for multiple users, utilizing a secure circuit and a secure enclave processor to authenticate users through biometric data and control access to applets via contactless registry service instances, ensuring only authorized users can access their information.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Quantity of substance
If a single secure element stores confidential information for multiple users, then storage efficiency is improved, but access control security deteriorates because it becomes difficult to ensure each user can only access their own information
Solution Approach 1:
The patent segments the secure element into multiple isolated secure enclaves, where each enclave is dedicated to a specific user. This segmentation allows multiple users to share the same secure element while maintaining strict access control boundaries, resolving the contradiction between storage efficiency and access control security.
Solution Approach 2:
Each secure enclave is assigned unique local qualities including dedicated cryptographic key pairs and isolated memory spaces. This local quality ensures that while the overall secure element serves multiple users efficiently, each user's data remains locally protected and inaccessible to other users.
2Reliability
If multiple instances of CRS applets are created for each user, then user-specific access control is improved, but device complexity increases
Solution Approach 1:
The patent creates separate secure enclaves for each user, with each enclave containing its own CRS applet instance. This segmentation provides strong user-specific access control while managing complexity through standardized enclave templates that can be replicated for multiple users.
Solution Approach 2:
The secure element is designed with universal capabilities to host multiple user enclaves using a standardized architecture. This multi-functionality allows the same hardware structure to serve multiple users with different access requirements, improving access control without proportionally increasing complexity.
3Reliability
If biometric authentication is implemented for each user, then authentication security is improved, but processing time increases
Solution Approach 1:
The patent stores biometric templates for multiple users in advance within the secure element's memory. When authentication is needed, the system quickly compares the presented biometric data against pre-stored templates, improving authentication security while reducing processing time compared to real-time template generation.
Data Source
AI summary
Techniques are disclosed relating to secure data storage. In various embodiments, a mobile device includes a wireless interface, a secure element, and a secure circuit. The secure element is configured to store confidential information associated with a plurality of users and to receive a request to communicate the confidential information associated with a particular one of the plurality of users. The secure element is further configured to communicate, via the wireless interface, the confidential information associated with the particular user in response to an authentication of the particular user. The secure circuit is configured to perform the authentication of the particular user. In some embodiments, the mobile device also includes a biosensor configured to collect biometric information from a user of the mobile device. In such an embodiment, the secure circuit is configured to store biometric information collected from the plurality of users by the biosensor.