Secure Element Session Key Encryption for Mobile Privacy
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current secure communication methods between client applications and secure elements in mobile devices lack encryption, non-repudiation, and integrity checks, making them vulnerable to attacks, especially since private keys are stored on the client application and can be compromised by 'sniffing' tools.
Innovation Solution
Implementing a session-based encryption method using a randomly generated session key, where the client application encrypts a request message with the user's unique public key and sends it to the secure element for decryption, and then encrypts the response with the same session key, ensuring that only the secure element processes the private key, thus eliminating the need for storing private keys on the client application.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If private keys are stored on the client application for secure communication, then authentication and encryption are enabled, but the system becomes vulnerable to sniffing tools and key compromise
Solution Approach 1:
The patent extracts the private key from the client application and stores it exclusively in the secure element. The client application only retains the public key, eliminating the vulnerability of storing private keys in accessible memory. This separation ensures that even if the client application is compromised, the private key remains protected in the secure element.
Solution Approach 2:
The patent introduces a secure element as an intermediary between the client application and the authentication server. This secure element acts as a trusted mediator that holds the private key and performs cryptographic operations, preventing direct exposure of the private key to the client application and eliminating the sniffing vulnerability.
2Reliability
If encryption is implemented for communications between client application and secure element, then confidentiality is improved, but device complexity increases due to key management requirements
Solution Approach 1:
The patent extracts complex key management responsibilities from the client application and concentrates them in the secure element. The secure element independently manages private keys and performs cryptographic operations, simplifying the client application's role to only holding public keys and initiating communications.
Solution Approach 2:
The secure element performs self-service by autonomously managing its own private keys and cryptographic operations without requiring the client application to handle sensitive key material. The secure element independently generates, stores, and uses cryptographic keys, eliminating the need for complex key management in the client application.
3Reliability
If session-based encryption with random session keys is used, then security against key compromise is improved, but communication overhead increases due to key exchange requirements
Solution Approach 1:
The patent performs preliminary action by establishing a secure communication channel and exchanging necessary cryptographic parameters before actual data transmission. The client application and secure element perform initial authentication and key setup procedures, allowing subsequent communications to use efficient encryption without repeated key exchange overhead.
Data Source
AI summary
Methods and systems for secure communication between a client application and a secure element on a mobile device involve, for example, encrypting a request including a randomly generated session key by the client application with a user's unique public key and sending the encrypted request to the secure element. The request message is decrypted with a user's unique private key on the secure element, a response message is encrypted with the session key retrieved from the decrypted request and sent to the client application, which decrypts the response with the session key.