Secure Secret Provisioning via Intermediary Communication Entity
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In the post-PC era, businesses face challenges in securely managing and deploying software applications on diverse mobile devices, such as smartphones and tablets, especially when employees use personally owned devices to access privileged company information, requiring secure and interoperable solutions for device management and security.
Innovation Solution
The system involves passing secrets wrapped with a first key to a communication entity, which establishes a secure channel with a device using a second key, allowing the device to unwrap the secrets, leveraging system-on-chip (SoC) architecture and trusted execution environments (TEEs) for secure key sharing and provisioning, enabling secure device management without relying on persistent data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If secrets are transmitted directly to applications on mobile devices, then provisioning is simple, but security is compromised
Solution Approach 1:
The patent introduces a communication entity as an intermediary between the authorization entity and the application on the mobile device. This intermediary receives wrapped secrets from the authorization entity, establishes a secure channel with the application using a second key, and forwards the wrapped secrets through this secure channel. The application then uses the first key to unwrap the secrets. This mediator approach maintains security while managing the complexity of key management and secure communication protocols.
2Reliability
If secure channels are established for every device, then security is improved, but time to provision secrets increases
Solution Approach 1:
The patent establishes secure channels and exchanges keys in advance during the provisioning phase. The communication entity sets up the secure channel with the application before actual secret transmission occurs. Keys are pre-configured and stored securely in the application, enabling rapid secret provisioning later without establishing new secure channels each time. This preliminary setup reduces latency during actual secret provisioning while maintaining security.
3Reliability
If multiple keys are used for secure communication, then security is enhanced, but key management complexity increases
Solution Approach 1:
The patent segments the key management system into distinct roles and key types. The first key is dedicated to unwrapping secrets and is stored securely in the application. The second key is used by the communication entity to establish secure channels. This segmentation of keys by function simplifies management compared to using a single key for all purposes, as each key has a specific, limited scope of use, reducing the complexity of key lifecycle management.
Data Source
AI summary
A system and method can support device management. An authorization entity can pass one or more secrets that are wrapped with a first key to a communication entity. Furthermore, the communication entity can use a second key to establish a secure channel with an application on a device, and pass the one or more secrets that are wrapped with the first key to the application on the device using the secure channel. Then, the device can use the first key to unwrap the received wrapped secret.