System and method of protecting data on a communication device

• US 20060190724A1
• Filed: 02/28/2003
• Published: 08/24/2006
• Est. Priority Date: 02/28/2003
• Status: Active Grant

• Current Assignee: Malikie Innovations Limited (Key Patent Innovations Limited)
• Original Assignee: Blackberry Limited
• Inventors: Adams, Neil P, Little, Herbert A.
• Granted Patent: US 8,078,869 B2
• Time in Patent Office: Days
• US Class Current: 713/166
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 21/71 to assure secure computing or processing of information
• CPC Class Codes: G06F 2221/2105 Dual mode as a secondary aspect
• CPC Class Codes: G06F 2221/2107 File encryption
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/045 wherein the sending and receiving network entities apply hybrid encryption, i.e. combination of symmetric and asymmetric encryption cryptographic mechanisms or cryptographic arrangements using a plurality of keys or algorithms H04L9/14
• CPC Class Codes: H04M 1/72403 with means for local support of applications that increase the functionality

Abstract

A system and method of protecting data on a communication device are provided. Data received when the communication device is in a first operational state is encrypted using a first cryptographic key and algorithm. When the communication device is in a second operational state, received data is encrypted using a second cryptographic key and algorithm. Received data is stored on the communication device in encrypted form.

Claims

1. A system of protecting data on a communication device having a first operational state and a second operational state, comprising:

a key store configured to store a plurality of cryptographic keys;

a memory configured to store data; and

a data protection system configured to receive data, to determine whether the communication device is in the first operational state or the second operational state, to encrypt the received data using a first of the plurality of cryptographic keys where the communication device is in the first operational state or a second of the plurality of cryptographic keys where the communication device is in the second operational state, and to store the encrypted received data in the memory.

2. The system of claim 1, wherein the second cryptographic key is inaccessible when the communication device is in the first operational state.

3. The system of claim 2, wherein the first operational state is a locked state and the second operational state is an unlocked state.

4. The system of claim 2, wherein the first cryptographic key is a public key, and the second cryptographic key is a symmetric key.

5. The system of claim 1, wherein the communication device comprises a wireless transceiver, and wherein the data protection system is configured to receive data from the wireless transceiver.

6. The system of claim 5, wherein the received data comprises confidential data received from a remote computer network via a wireless communication network.

7. The system of claim 5, wherein the communication device further comprises a connector, and wherein the data protection system is further configured to receive data from the connector.

8. The system of claim 7, wherein the connector is selected from the group consisting of:

a serial port, a Universal Serial Bus (USB) port, a Secure Digital (SD) slot, and a short-range wireless communication module.

9. The system of claim 4, wherein the data protection system is further configured to receive a request for data, to determine whether the communication device is in the second operational state, and to decrypt the requested data where the communication device is in the second operational state.

10. The system of claim 9, wherein the request includes encrypted data to be decrypted by the data protection system.

11. The system of claim 9, wherein the request identifies requested data, and wherein the data protection system retrieves and decrypts the requested data.

12. The system of claim 10, wherein the public key is associated with a private key, and wherein the data protection system is further configured to determine whether the encrypted data was encrypted using the public key or the symmetric key, to decrypt the encrypted data using the private key where the encrypted data was encrypted using the public key, and to decrypt the encrypted data using the symmetric key where the encrypted data was encrypted using the symmetric key.

13. The system of claim 12, wherein the data protection system is further configured to store the decrypted data on the communication device, and to delete the decrypted data when the communication device enters the first operational state.

14. The system of claim 13, wherein the symmetric key and the private key are stored in encrypted form on the communication device, and wherein the data protection system is further configured to decrypt the private key and store the decrypted private key on the communication device where the requested data was encrypted using the public key, to decrypt the symmetric key and store the decrypted symmetric key on the communication device where the requested data was encrypted using the symmetric key, and to delete the decrypted private key and the decrypted symmetry key when the communication device enters the first operational state.

15. The system of claim 1, wherein the data protection system is further configured to determine whether the received data is related to existing data stored in the memory, and to append the encrypted received data to the existing related data in the memory where the received data is related to existing data.

16. The system of claim 15, wherein the encrypted received data and the existing data comprise data blocks of a data item, and wherein the data item further comprises an identifier indicating whether each data block was encrypted using the first cryptographic key or the second cryptographic key.

17. The system of claim 1, wherein the communication device comprises a wireless mobile communication device selected from the group consisting of:

a data communication device, a mobile telephone having both data and voice communications functionality, a multiple-mode device capable of voice, data and other types of communications, a messaging device, a personal digital assistant (PDA) enabled for wireless communications, a wireless modem, a one-way communication device, and a two-way communication device.

18. A method of protecting data on a communication device comprising the steps of:

storing a first protected cryptographic key and a second cryptographic key on the communication device;

receiving data at the communication device;

determining whether the first protected cryptographic key is accessible;

encrypting the received data using the first protected cryptographic key where the first protected cryptographic key is accessible;

encrypting the received data using the second cryptographic key where the first protected cryptographic key is inaccessible; and

storing the encrypted received data in memory on the communication device.

19. The method of claim 18, wherein the communication device has a locked operational state in which the first protected cryptographic key is inaccessible and an unlocked operational state in which the first protected cryptographic key is accessible, and wherein the step of determining comprises the step of determining whether the communication device is in the locked operational state or the unlocked operational state.

20. The method of claim 19, wherein the first protected cryptographic key is a symmetric key, wherein the second cryptographic key is a public key associated with a private key, and wherein the method further comprises the step of storing the private key on the communication device.

21. The method of claim 18, wherein the communication device is a wireless mobile communication device, and wherein the step of receiving comprises the step of receiving confidential data from a remote computer network via a wireless communication network.

22. The method of claim 20, further comprising the steps of:

receiving a request for data from a system on the communication device;

determining whether the requested data was encrypted using the symmetric key or the public key;

decrypting the requested data using the symmetric key where the requested data was encrypted using the symmetric key; and

decrypting the requested data using the private key where the requested data was encrypted using the private key.

23. The method of claim 22, wherein the request includes encrypted data to be decrypted.

24. The method of claim 22, wherein the request identifies requested data, and wherein the method further comprises the step of retrieving the requested data.

25. The method of claim 22, further comprising the steps of:

storing the decrypted data on the communication device; and

deleting the decrypted data when the communication device enters the locked operational state.

26. The method of claim 25, wherein:

the step of storing the first protected cryptographic key and the second cryptographic key on the communication device comprises the steps of encrypting the symmetric key and storing the encrypted symmetric key on the communication device;

the step of storing the private key on the communication device comprises the steps of encrypting the private key and storing the encrypted private key on the communication device;

the step of decrypting the requested data using the symmetric key comprises the step of decrypting the encrypted symmetric key;

the step of decrypting the requested data using the private key comprises the step of decrypting the encrypted private key.

27. The method of claim 26, wherein the step of decrypting the requested data using the symmetric key further comprises the step of storing the decrypted symmetric key on the communication device, and wherein the step of decrypting the requested data using the private key further comprises the step of storing the decrypted private key on the communication device.

28. The method of claim 27, wherein:

the step of decrypting the requested data using the symmetric key further comprises the steps of determining whether the decrypted symmetric key is stored on the communication device, and retrieving the decrypted symmetric key where the decrypted symmetric key is stored on the communication device; and

the step of decrypting the requested data using the private key further comprises the steps of determining whether the decrypted private key is stored on the communication device, and retrieving the decrypted private key where the decrypted private key is stored on the communication device.

29. The method of claim 27, further comprising the step of deleting the decrypted symmetric key and the decrypted private key when the communication device enters the locked operational state.

30. The method of claim 18, wherein the received data comprises a data item having a data item identifier, and wherein the method further comprises the steps of:

creating a data item reference comprising the data item identifier and a location of the encrypted received data in the memory; and

storing the data item reference in the memory.

31. The method of claim 18, wherein the step of storing the encrypted received data comprises the steps of:

determining whether the received data is related to existing data stored in the memory; and

appending the encrypted received data to the existing related data in the memory where the received data is related to existing data.

32. The method of claim 31, wherein the received data and the existing related data comprise data blocks of a data item, wherein the data item is associated with a data item reference comprising a data item identifier and a location of the existing related data in the memory, and wherein the step of appending the encrypted received data comprises the steps of:

determining a length of the encrypted received data;

generating an identifier indicating whether the encrypted received data was encrypted using the first protected cryptographic key or the second cryptographic key;

adding the length and the identifier to the encrypted received data; and

appending the length, the identifier, and the encrypted received data to the existing related data.

33. The method of claim 18, wherein the received data comprises a data item having a data item identifier, and wherein the method further comprises the steps of:

creating a data item header comprising the data item identifier, a block length of the encrypted received data, a location of the encrypted received data in the memory, and a key identifier indicating whether the encrypted received data was encrypted using the first protected cryptographic key or the second cryptographic key; and

storing the data item header in the memory.

34. The method of claim 33, wherein the step of storing the encrypted received data comprises the steps of:

determining whether the received data is related to existing data and an existing data header stored in the memory; and

where the received data is related to existing data and an existing data header,

determining a length of the encrypted received data;

generating an identifier indicating whether the encrypted received data was encrypted using the first protected cryptographic key or the second cryptographic key;

adding the determined length and the generated identifier to the data item header; and

appending the encrypted received data to the existing related data.

35. The method of claim 18, wherein the step of encrypting the received data using the first protected cryptographic key comprises the steps of:

determining whether the received data is related to existing encrypted data stored in the memory;

determining whether the existing encrypted data was encrypted using the first protected cryptographic key where the received data is related to existing encrypted data stored in the memory; and

where the existing encrypted data was encrypted using the first protected cryptographic key,

decrypting the existing encrypted data using the first protected cryptographic key;

appending the received data to the decrypted existing data to form a combined data block; and

encrypting the combined data block using the first protected cryptographic key.

36. The method of claim 32, wherein the second cryptographic key is associated with a private decryption key, wherein the step of storing a first protected cryptographic key and a second cryptographic key on the communication device comprises the step of storing the private decryption key on the communication device, and wherein the method further comprises the steps of:

receiving a request for the data item from a system on the communication device;

for each data block in the data item,

determining whether the data block was encrypted using the first protected cryptographic key or the second cryptographic key;

decrypting the data block using the first protected cryptographic key where the data block was encrypted using the first protected cryptographic key; and

decrypting the data block using the private decryption key where the data block was encrypted using the private key; and

providing the decrypted data item comprising each decrypted data block to the system on the communication device.

37. The method of claim 36, further comprising the steps of:

for each data block in the data item that was encrypted using the second cryptographic key,

encrypting the decrypted data block using the first protected cryptographic key to generate a re-encrypted data block; and

replacing the data block with the re-encrypted data block in the memory.

38. The method of claim 36, further comprising the steps of:

encrypting the decrypted data item using the first protected cryptographic key to generate a re-encrypted data item; and

replacing the data item in the memory with the re-encrypted data item.

39. The method of claim 18, further comprising the steps of:

enabling data protection on the communication device;

determining whether a locked operational state in which the first protected cryptographic key is inaccessible is enabled on the communication device;

prompting a user of the communication device to enable the locked operational state where the locked operation state has not been enabled on the communication device; and

generating the first protected cryptographic key, the second cryptographic key, and a decryption key associated with the second cryptographic key where the locked operational state is enabled on the communication device.

40. The method of claim 39, wherein the step of generating comprises the step of collecting pseudo-random information from user inputs to the communication device.

41. The method of claim 18, wherein the communication device comprises a wireless mobile communication device selected from the group consisting of:

a data communication device, a mobile telephone having both data and voice communications functionality, a multiple-mode device capable of voice, data and other types of communications, a messaging device, a personal digital assistant (PDA) enabled for wireless communications, a wireless modem, a one-way communication device, and a two-way communication device.

42. A system of protecting data on a communication device comprising:

means for storing a first protected cryptographic key and a second cryptographic key on the communication device;

means for receiving data at the communication device;

means for determining whether the first protected cryptographic key is accessible;

means for encrypting the received data using the first protected cryptographic key where the first protected cryptographic key is accessible;

means for encrypting the received data using the second cryptographic key where the first protected cryptographic key is inaccessible; and

means for storing the encrypted received data in memory on the communication device.