# US 10,771,964 B2 · Systems and methods for providing encrypted storage within application sandbox

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 10,771,964 B2
- Document ID: US10771964B2
- Status: Granted
- Kind: B2
- Application number: 16/202,582
- Filed: 2018-11-28
- Published: 2020-05-28
- Granted: 2020-09-08
- Earliest claimed: 2018-11-28
- Assignees: JPMorgan Chase Bank, N.A.
- Applicants: JPMorgan Chase Bank, N.A.
- Inventors: Gayathri Sundar
- Web page: https://patentgrep.com/patent/US10771964B2

## CPC

- H04L 9/0631: {Substitution permutation network [SPN], i.e. cipher composed of a number of stages or rounds each involving linear and nonlinear transformations, e.g. AES algorithms}
- H04W 12/02: Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
- G06F 21/53: by executing in a restricted environment, e.g. sandbox or secure virtual machine
- G06F 21/602: {Providing cryptographic facilities or services}
- G06F 21/78: to assure secure storage of data (address-based protection against unauthorised use of memory G06F12/14; record carriers for use with machines and with at least a part designed to carry digital markings G06K19/00)
- H04L 9/14: using a plurality of keys or algorithms
- H04L 9/3066: {involving algebraic varieties, e.g. elliptic or hyper-elliptic curves}
- H04L 9/3247: {involving digital signatures}
- H04L 9/3271: {using challenge-response}
- H04L 63/166: {at the transport layer}
- H04W 12/041: Key generation or derivation
- H04W 12/0431: Key distribution or pre-distribution; Key agreement
- H04W 12/06: Authentication
- H04W 12/30: Security of mobile devices; Security of mobile applications
- G06F 2221/2149: Restricted operating environment
- H04L 2209/80: Wireless
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

Systems and methods for providing encrypted storage within application sandbox are disclosed. Embodiments may secure data at rest on mobile device within application sandbox. The data may be stored in a manner that is resistant to attacks intended to reveal the data, and situations in which unintentional disclosures could occur. In embodiments, data may not be unintentionally lost, and it may be used with data that may be classified as Personally Identifiable Information.

## Claims

### Claim 1

A method for providing encrypted storage, comprising:
in a mobile electronic device comprising at least one computer processor executing a mobile application:
establishing a valid session with a user;
deriving a Device Private Key and a Device Public Key;
generating a Device Random Number;
sending the Device Random Number and the Device Public key to an authentication platform;
receiving, from the authentication platform, a Server Public Key, a Server Random Number, and a Server AES (Advanced Encryption Standard) Key, the Server Public Key, the Server Random Number, and the Server AES Key wrapped with the Device Public Key;
unwrapping the Server Public Key, the Server Random Number, and the Server AES Key;
generating a Device AES Key based on the Server Random Number and a New Device Random Number;
generating a Master AES Cache Key based on the Device AES Key and the Server AES Key; and
encrypting data with the Master AES Cache Key and storing the encrypted data in secure storage.

### Claim 2 (depends on 1)

The method of claim 1, wherein the Device Private Key and the Device Public Key are an elliptic-curve cryptography key pair.

### Claim 3 (depends on 1)

The method of claim 1, wherein the Device Random Number and the Device Public Key are sent to the authentication platform using a transport security layer tunnel.

### Claim 4 (depends on 1)

The method of claim 1, wherein the Server AES Key is generated by XORing the Device Random Number with a New Server Random Number.

### Claim 5 (depends on 1)

The method of claim 1, wherein the mobile application generates the Device AES Key by XORing the New Device Random Number with the Server Random Number.

### Claim 6 (depends on 1)

The method of claim 1, wherein the mobile application generates the Master AES Cache Key by XORing the Device AES Key with the Server AES Key.

### Claim 7 (depends on 1)

The method of claim 1, further comprising:
encrypting at least one of one of the Device Public Key, the Device Random Number, the Server Public Key, and the Server Random Number with a bootstrap key.

### Claim 8 (depends on 1)

The method of claim 1, wherein the step of encrypting data with the Master AES Cache Key and storing the encrypted data in secure storage comprises:
splitting the Master AES Cache Key into a plurality of components; and
encrypting the data successively with each of the plurality of components.

### Claim 9

A method for data decryption, comprising:
in a mobile electronic device comprising at least one computer processor executing a mobile application:
requesting a challenge from an authentication platform;
receiving the challenge from the authentication platform;
signing the challenge with a Device Private Key and communicating the signed challenge to the authentication platform;
receiving a Server AES (Advanced Encryption Standard) Key wrapped with the Device Public Key from the authentication platform;
unwrapping a Device AES Key and the Server AES Key;
computing a Master AES Cache Key based on the Device AES Key and the Server AES Key; and
decrypting encrypted data with the Master AES Cache Key.

### Claim 10 (depends on 9)

The method of claim 9, wherein the Master AES Cache Key is computed by XORing the Device AES Key with the Server AES Key.

### Claim 11 (depends on 9)

The method of claim 9, wherein the Device Private Key and the Device Public Key are an elliptic-curve cryptography key pair.

### Claim 12 (depends on 9)

The method of claim 9, wherein the mobile application and the authentication platform communicate using a transport security layer tunnel.

### Claim 13 (depends on 9)

The method of claim 9, wherein the authentication platform generates the Server AES Key by XORing the Device Random Number with a New Server Random Number.

### Claim 14

A system for providing encrypted storage, comprising:
a mobile electronic device comprising at least one computer processor executing a mobile application; and
an authentication platform;
wherein:
the mobile application derives a Device Private Key and a Device Public Key;
the mobile application generates a Device Random Number;
the mobile application sends the Device Random Number and the Device Public key to the authentication platform;
the authentication platform generates a Server Public Key, a Server Random Number, and a Server AES (Advanced Encryption Standard) Key;
the authentication platform wraps the Server Public Key, the Server Random Number, and the Server AES Key with the Device Public Key and sends the wrapped Server Public Key, Server Random Number, and Server AES Key to the mobile application;
the mobile application unwraps the Server Public Key, the Server Random Number, and the Server AES Key;
the mobile application generates a Device AES Key using the Server Random Number and a New Device Random Number;
the mobile application generates a Master AES Cache Key based on the Device AES Key and the Server AES Key; and
the mobile application encrypts data with the Master AES Cache Key and stores the encrypted data in secure storage.

### Claim 15 (depends on 14)

The system of claim 14, wherein the Device Private Key and the Device Public Key are an elliptic-curve cryptography key pair.

### Claim 16 (depends on 14)

The system of claim 14, wherein the authentication platform generates the Server AES Key by XORing the Device Random Number with a New Server Random Number.

### Claim 17 (depends on 14)

The system of claim 14, wherein the mobile application generates the Device AES Key by XORing the New Device Random Number with the Server Random Number.

### Claim 18 (depends on 14)

The system of claim 14, wherein the mobile application generates the Master AES Cache Key by XORing the Device AES Key with the Server AES Key.

### Claim 19 (depends on 14)

The system of claim 14, further comprising:
wherein the mobile application or the authentication platform encrypts at least one of one of the Device Public Key, the Device Random Number, the Server Public Key, and the Server Random Number with a bootstrap key.

### Claim 20 (depends on 14)

The system of claim 14, wherein the data is encrypted with the Master AES Cache Key by splitting the Master AES Cache Key into a plurality of components; and encrypting the data successively with each of the plurality of components.