METHOD AND SYSTEM FOR CREDENTIAL MANAGEMENT AND DATA ENCRYPTION FOR iOS BASED DEVICES

• US 20130067232A1
• Filed: 09/09/2011
• Published: 03/14/2013
• Est. Priority Date: 09/09/2011
• Status: Abandoned Application

• Current Assignee: ECHOWORX Corporation
• Original Assignee: Christian Peel
• Inventors: PEEL, Christian, CHEUNG, Kai Chung, HAPPE, Sarah Heather Christine
• Application Number:
  US13/228,930
• Publication Number:
  US 20130067232A1
• Time in Patent Office: Days
• US Class Current: 713/176
• CPC Class Codes: G06F 21/6209 to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
• CPC Class Codes: G06F 2221/2107 File encryption
• CPC Class Codes: H04L 2209/80 Wireless
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/126 the source of the received data
• CPC Class Codes: H04L 9/3247 involving digital signatures
• CPC Class Codes: H04W 12/03 Protecting confidentiality, e.g. by encryption
• CPC Class Codes: H04W 12/04 Key management, e.g. using generic bootstrapping architecture [GBA]
• CPC Class Codes: H04W 12/10 Integrity

Abstract

A mechanism and method for managing credentials on an electronic device and providing encryption and decryption services for the electronic device comprising a mobile communication device, smart phone or other computing device. According to an embodiment the device is configured with an iOS based operating system. The device is configured with a data encryption service application and an associated secure data repository. According to an embodiment, the electronic device is configured to download and/or cache credentials from a credential management system operatively coupled to the device, comprising public-private key pairs in a PKI system. According to an embodiment, the electronic device is configured with or stores a digital verification signature. The data encryption service application is configured to encrypt/decrypt data (e.g. files, documents) and optionally digitally sign the encrypted file. The encrypted (and digitally signed data) is contained in the sandbox associated with the data encryption service application.

Claims

1. A device configured for communication over a network, said device comprising:

an encryption module configured to encrypt and/or decrypt data utilizing credentials associated with the device;

a component configured to retrieve said credentials;

a component configured to store a digital signature;

a component configured to sign said encrypted data using said digital signature; and

a secure data repository configured on the device and associated with said encryption module to store said encrypted and signed data.

2. The device as claimed in claim 1, further including a component configured for verifying said digital signature.

3. The device as claimed in claim 1, wherein said credentials are retrieved from a credential management system.

4. The device as claimed in claim 1, further including a component configured to upload and/or download said encrypted and signed data to/from a data cloud service.

5. The device as claimed in claim 1 configured with an application and further including a component configured to return said encrypted and signed data to said application.

6. The device as claimed in claim 1, configured with an operating system comprising iOS operating system and said secure data repository comprising a sandbox configured under said iOS operating system.

7. A computer-implemented method for securing data associated with an application running on a device, said method comprising the steps of:

encrypting the data;

applying a digital signature to said encrypted data;

configuring a secure data repository on the device; and

storing said encrypted and signed data in said secure data repository configured on the device.

8. The computer-implemented method as claimed in claim 7, wherein said step of storing said encrypted and signed data comprises uploading said encrypted and signed data to a data service remote from the device.

9. The computer-implemented method as claimed in claim 7, wherein the device is configured with an operating system comprising iOS and said secure data repository comprises a sandbox configured under the iOS operating system.

10. The computer-implemented method as claimed in claim 9, wherein the device comprises a mobile communication device.

11. The computer-implemented method as claimed in claim 9, wherein credentials including said digital signature are obtained from a credential management system.

12. The computer-implemented method as claimed in claim 8, wherein the device is configured with an operating system comprising iOS and said secure data repository comprises a sandbox configured under the iOS operating system, and the data service comprises an iCloud data service remote from the device.

13. The computer-implemented method as claimed in claim 7, further including the steps of:

loading said encrypted and signed data from said secure data repository, decrypting the data and verifying said digital signature and making the data available for the application.

14. The computer-implemented method as claimed in claim 8, further including the steps of downloading said encrypted and signed data from said remote data service, decrypting the data and verifying said digital signature and making the data available for the application.

15. The computer-implemented method as claimed in claim 14, wherein the device is configured with an operating system comprising iOS and said secure data repository comprises a sandbox configured under the iOS operating system, and the data service comprises an iCloud data service remote to the device.

16. The computer-implemented method as claimed in claim 7, wherein the device is configured to run two or more applications, and further including an inter-process communication step for transferring data between said two or more applications.

17. A computer program product for securing data associated with an application running on a computing device, said computer program product comprising:

a storage medium configured to store computer readable instructions;

said computer readable instructions including instructions for, encrypting the data;

applying a digital signature to said encrypted data; and

storing said encrypted and signed data in a secure data repository configured on the device.

18. The computer program product as claimed in claim 17, wherein the device is configured with an operating system comprising iOS and said secure data repository comprises a sandbox configured under the iOS operating system.

19. The computer program product as claimed in claim 17, wherein said instructions for storing said encrypted and signed data comprises instructions for uploading said encrypted and signed data to a data service remote from the device.

20. The computer program product as claimed in claim 19, wherein the device is configured with an operating system comprising iOS and said secure data repository comprises a sandbox configured under the iOS operating system, and the data service comprises an iCloud data service remote from the device.