METHOD AND SYSTEM FOR PROVIDING DATA SECURITY

• US 20150244522A1
• Filed: 02/25/2015
• Published: 08/27/2015
• Est. Priority Date: 02/26/2014
• Status: Abandoned Application

• Current Assignee: Samsung Electronics Co. Ltd.
• Original Assignee: Samsung Electronics Co. Ltd.
• Inventors: CHERUVATH, Muhammad Saheer, SIVARAJAN, Perumal Raj
• Application Number:
  US14/631,127
• Publication Number:
  US 20150244522A1
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: H04L 9/085 Secret sharing or secret splitting, e.g. threshold schemes
• CPC Class Codes: H04L 9/0894 Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage
• CPC Class Codes: H04L 9/3226 using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083

Abstract

Embodiments herein provide a method for data security. A data passcode used for data encryption in electronic devices is encrypted and secret shares of the encrypted passcode are distributed to multiple entities. Recovery of the passcode and the encrypted data is performed by obtaining the secret shares from the multiple entities to reconstruct the passcode used for data encryption.

Claims

1. A method of providing data security, the method comprising:

generating a plurality of secret shares for an encrypted passcode; and

distributing each the secret share to a plurality of entities, wherein the plurality of entities are separated physically.

2. The method of claim 1, wherein generating a plurality of secret shares for an encrypted passcode comprises:

obtaining the passcode;

encrypting one of;

the passcode and passcode hash; and

generating the plurality of secret shares for one of;

the encrypted passcode and encrypted passcode hash.

3. The method of claim 1, wherein the plurality of shares is generated based on a threshold.

4. The method of claim 1, wherein the method further comprises:

receiving a recovery request to recover at least one of an encrypted data and the passcode;

obtaining each the secret share from the plurality of entities;

recovering the passcode by reconstructing the passcode; and

recovering an encrypted data by decrypting the encrypted data using the reconstructed passcode.

5. The method of claim 4, wherein the encrypted data is recovered based on at least one policy.

6. A system for data security, the system comprising an electronic device managed by a Mobile Device Management (MDM) server, wherein the system is configured to:

generate a plurality of secret shares for an encrypted passcode; and

distribute each the secret share to a plurality of entities, wherein the plurality of entities is separated physically.

7. The system of claim 6, wherein a recovery module in the electronic device is configured to:

obtain the passcode;

encrypt one of;

the passcode and passcode hash; and

generate the plurality of secret shares for one of;

the encrypted passcode and encrypted passcode hash.

8. The system of claim 6, wherein the plurality of shares is generated based on a threshold, wherein the MDM server is configured to determine the threshold.

9. The system of claim 6, wherein the recovery module in the electronic device is further configured to:

receive a recovery request to recover at least one of an encrypted data and the passcode;

obtain each the secret share from the plurality of entities;

recover the passcode by reconstructing the passcode; and

recover an encrypted data by decrypting the encrypted data using the reconstructed passcode.

10. The system of claim 9, wherein the encrypted data is recovered based on at least one policy.

11. A computer program product comprising computer executable program code recorded on a computer readable a non-transitory storage medium, the computer executable program code when executed, causing the actions including:

generating a plurality of secret shares for an encrypted passcode; and

distributing each the secret share to a plurality of entities, wherein the plurality of entities are separated physically.

12. The computer program product of claim 11, wherein the computer executable program code when executed, further causing the actions including:

obtaining the passcode;

encrypting one of;

the passcode and passcode hash; and

generating the plurality of secret shares for one of;

the encrypted passcode and encrypted passcode hash

13. The computer program product of claim 11, wherein the plurality of shares is generated based on a threshold.

14. The computer program product of claim 11, wherein the computer executable program code when executed, further causing the actions including:

receiving a recovery request to recover at least one of an encrypted data and the passcode;

obtaining each the secret share from the plurality of entities;

recovering the passcode by reconstructing the passcode; and

recovering an encrypted data by decrypting the encrypted data using the reconstructed passcode.

15. The computer program product of claim 14, wherein the encrypted data is recovered based on at least one policy.