Server-Assisted Keystore Protection for Mobile Devices
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Unsecure devices lack reliable two-factor cryptography due to limitations in preserving the integrity and confidentiality of secrets, as they cannot reliably provide the 'what you have' factor, and short passphrases are burdensome and vulnerable to brute-force attacks.
Innovation Solution
A method involving a device requesting a personal code, calculating a function of the code, and sending it to a server for verification, which returns the passphrase for unlocking the data store, using checksums and one-time nonces to ensure security and detect cloning, while encrypting communications to maintain confidentiality.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a long passphrase is used to encrypt the keystore, then security against brute-force attacks is improved, but ease of operation deteriorates due to burden on users with limited keyboard capabilities
Solution Approach 1:
The authentication mechanism is segmented into two independent parts: a short personal code entered by the user on the device, and a separate passphrase stored and managed by the server. This segmentation allows the user to interact only with the short code while the server handles the secure passphrase, resolving the contradiction between security and ease of operation.
Solution Approach 2:
The server acts as an intermediary between the user and the keystore encryption. Instead of requiring users to directly manage long passphrases, the server mediates the authentication process by verifying the personal code and providing cryptographic assistance, thereby maintaining security while improving usability.
2Ease of operation
If a short passphrase or PIN is used, then ease of operation is improved, but security deteriorates due to vulnerability to brute-force and dictionary attacks
Solution Approach 1:
The authentication system is divided such that the short personal code serves only as an initial verification factor, while the actual keystore decryption relies on a separate strong passphrase managed by the server. This segmentation ensures that the short code's ease of use does not compromise security.
Solution Approach 2:
The server intermediates the authentication process by verifying the personal code and then providing cryptographic assistance for keystore access. This mediation ensures that even though a short code is used, the security level depends on the server-protected passphrase rather than the weak code.
3Ease of operation
If the keystore is stored on an unsecure device, then ease of operation is improved, but security deteriorates because the keystore can be cloned to other devices
Solution Approach 1:
The server acts as a trusted intermediary that verifies device identity and provides cryptographic assistance for keystore access. This intermediary role enables the keystore to remain on the unsecure device while preventing unauthorized cloning, as the server controls and validates access based on device identification.
Solution Approach 2:
The system implements feedback mechanisms where the server verifies device identity and monitors access patterns. This feedback loop allows the system to detect and prevent cloning attempts while maintaining convenient local access to the keystore.
Data Source
Figure 1~3
AI summary
The present invention relates to a method to access a data store (DS) previously locked using a passphrase (PP) from a device (UD), said method including the following steps, when the user request access to the data store (DS): requesting (E0) the user to enter the personal code (PIN), generating (E2) an access code (AC) by applying said first function (F1) to at least the entered personal code (PIN); sending out (E3), to the server (SV), at least an identifier (IDUD) of the device (UD) and the access code (AC); for the server (SV), comparing (E4) the access code (AC) with the preliminary received first function; for the server (SV), if the access code (AC) is correct, returning the passphrase (PP) to the device (UD); for the device (DV), unlocking the data store (DS) using the received passphrase (PP) in combination with the entered personal code (PIN).