Trusted Device Network for Secure Mobile Data Decryption
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Users often forget authentication data for networked applications, leading to insecure storage practices, and existing solutions do not adequately ensure secure retrieval of sensitive information.
Innovation Solution
A system comprising a managing device and a keyholding device, where the managing device encrypts data using an encryption key stored on the keyholding device, requiring physical proximity and secure communication protocols to establish a connection and retrieve the decryption key, ensuring secure data retrieval.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If authentication data is stored securely, then security is improved, but ease of access deteriorates
Solution Approach 1:
The authentication system is segmented into multiple independent components: the managing device that stores encrypted authentication data, the keyholding device that securely stores the decryption key, and the trusted device list that manages device identities. This segmentation ensures that no single device holds both the encrypted data and the decryption key, improving security while maintaining accessibility through coordinated device interaction.
Solution Approach 2:
A trusted device list acts as an intermediary between the managing device and keyholding device. The trusted device list verifies device identities and manages the trusted relationships, enabling secure key retrieval without requiring direct trust between all devices. This intermediary mechanism resolves the contradiction by providing structured, verified access paths.
2Ease of operation
If encryption key is stored locally, then ease of decryption is improved, but security deteriorates
Solution Approach 1:
The decryption key is extracted from the managing device and stored in a separate keyholding device. The managing device contains only encrypted authentication data, while the keyholding device securely stores the decryption key. This extraction eliminates the security risk of local key storage while maintaining decryption capability through secure inter-device communication.
Solution Approach 2:
The keyholding device is pre-configured with the decryption key and registered in the trusted device list before any decryption operation. This preliminary setup enables rapid, secure key retrieval when needed, maintaining ease of decryption while ensuring the key is never stored on the managing device itself.
3Reliability
If multiple devices are involved in key management, then security is improved, but device complexity increases
Solution Approach 1:
The trusted device list serves multiple functions: it stores device identifiers, verifies device identities, manages trusted relationships, and coordinates key retrieval operations. This multi-functional component reduces overall system complexity by consolidating management tasks into a single universal mechanism rather than requiring separate protocols for each function.
Solution Approach 2:
Instead of having devices actively seek and verify each other's credentials, the trusted device list maintains a centralized registry of trusted devices. When a managing device needs decryption, it queries the trusted device list rather than performing complex mutual authentication protocols, inverting the approach from active verification to passive query-based access.
Data Source
AI summary
A system including a managing device communicatively coupled to a keyholding device. The managing device includes a data manager executing on the processor configured to receive a request to decrypt encrypted data from a protected application and obtain the keyholding device identifier from a trusted device list. The data manager is further configured to send a connection request to the keyholding device using the keyholding device identifier and create an established connection in response to determining that the keyholding device has accepted the connection request. The data manager is further configured to request, via the established connection, the encryption key from a keyholding process executing on the keyholding device and obtain the encryption key from the keyholding process on keyholding device. The data manager is further configured to decrypt the encrypted data using encryption key to obtain decrypted data and send the decrypted data to the protected application.