Effective data protection for mobile devices
AssigneePomian & Corella, LLC
InventorsFrancisco Corella, Karen Pomian Lewison
Life of this patent
Estimating the term…
Abstract
A method of protecting confidential data stored in a computing device. In one embodiment, data items are encrypted using content-encryption keys that are not present in the device while the device is locked. When a user unlocks the device, the content- encryption keys are computed using at least one externally stored key that is retrieved from a key storage service using a credential regenerated from a protocredential stored in the device and one or more secrets supplied by a user.
Claims20
A method of protecting confidential data stored in a computing device, comprising:
- storing the confidential data in encrypted form;
- regenerating a credential from a protocredential stored in the device and one or more secrets not stored in the device;
- requesting a content-encryption key from a key storage service, the credential being used to authenticate the request;
- and
- using the content-encryption key to decrypt the confidential data.
A method of protecting confidential data stored in a computing device, comprising:
- storing the confidential data in encrypted form;
- regenerating a credential from a protocredential stored in the device and one or more secrets not stored in the device;
- requesting an externally stored key from a key storage service, the credential being used to authenticate the request;
- performing a computation of a content-encryption key using the externally stored key as an input to the computation;
- and
- using the content-encryption key to decrypt the confidential data.
A computing device, comprising:
- one or more processors;
- and
- a storage subsystem containing encrypted confidential data and containing instructions executable by the one or more processors for:
- regenerating a credential from a protocredential stored in the device and one or more secrets not stored in the device;
- requesting an externally stored key from a key storage service, the credential being used to authenticate the request;
- performing a computation of a content-encryption key using the externally stored key as an input to the computation;
- and
- using the content-encryption key to decrypt the confidential data.
A system, comprising:
- a computing device;
- a key storage service containing an externally stored key of the computing device;
- and
- a network connecting the computing device to the key storage service,
- wherein the computing device comprises:
- one or more processors;
- and
- a storage subsystem containing encrypted data and containing instructions executable by the one or more processors for:
- regenerating a credential from a protocredential stored in the device and one or more secrets not stored in the device;
- requesting an externally stored key from a key storage service, the credential being used to authenticate the request;
- performing a computation of a content-encryption key using the externally stored key as an input to the computation;
- and
- using the content-encryption key to decrypt the confidential data.
Dependencies are inferred from the claim text.