Systems and methods for controlling access to encrypted data stored on a mobile device

• US 8,166,297 B2
• Filed: 07/02/2008
• Issued: 04/24/2012
• Est. Priority Date: 07/02/2008
• Status: Active Grant

• Current Assignee: Samsung Electronics Co. Ltd.
• Original Assignee: Veritrix, Inc.
• Inventors: Headley, Paul
• Primary Examiner(s): Song, Hosuk
• Application Number:
  US12/166,792
• Publication Number:
  US 20100005296A1
• Time in Patent Office: 1,392 Days
• Field of Search: 380/270, 713/168, 713182-186, 726 2- 5, 726 16- 20
• US Class Current: 713/168
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 9/0819 Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) network architectures or network communication protocols for key distribution in a packet data network H04L63/062
• CPC Class Codes: H04L 9/0827 involving distinctive intermediate devices or communication paths network architectures or network communication protocols using different networks H04L63/18
• CPC Class Codes: H04L 9/083 involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP]
• CPC Class Codes: H04L 9/3226 using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083
• CPC Class Codes: H04L 9/3231 Biological data, e.g. fingerprint, voice or retina network architectures or network communication protocols for supporting authentication of entities using biometrical features in a packet data network H04L63/0861
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823

Abstract

Encrypted data on mobile devices is protected by remotely storing a decryption key. In order to decrypt the encrypted data on the mobile device, the mobile device obtains the decryption key from an access control system that is remote from the mobile device. The access control system can control access to the encrypted data by controlling access to the decryption key. For example, the access control system can implement user authentication as a condition for providing the decryption key. Access to the encrypted data can also be controlled by withholding the decryption key where, for instance, a mobile device has been reported to be lost or stolen, or once an individual'"'"'s access privilege has been revoked, or at certain times of the day.

Claims

1. A method for accessing encrypted data with a mobile device, the method comprising:

prearranging a response to a prompt;

obtaining a decryption key from an access control system including

receiving a prompt for a claimant target,

submitting the claimant target,

receiving the prompt over a first communication channel from the access control system,

providing the response to the access control system, and

receiving by the mobile device the decryption key from the access control system; and

using the decryption key to decrypt the encrypted data with the mobile device.

2. The method of claim 1 wherein prearranging the response to the prompt includes establishing a password as the response.

3. The method of claim 1 wherein prearranging the response to the prompt includes establishing a biometric response as the response.

4. The method of claim 1 wherein the prompt comprises a personalized prompt.

5. The method of claim 1 wherein the prompt is one of a plurality of prompts.

6. The method of claim 1 wherein the response to the access control system is provided over the first communication channel.

7. The method of claim 1 wherein the response to the access control system is provided over a second communication channel.

8. The method of claim 1 wherein the response is a biometric response.

9. A method for controlling access to encrypted data stored on a mobile device, the method comprising:

sending a first prompt for a claimant target to the mobile device,

receiving the claimant target,

sending a second prompt to the mobile device over a first communication channel;

receiving a claimant response to the second prompt;

determining a match between the claimant response and a response template associated with the second prompt; and

sending a decryption key to the mobile device after determining the match.

10. The method of claim 9 further comprising storing the response template in association with the second prompt.

11. The method of claim 9 further comprising receiving a request for the decryption key from the mobile device before sending the second prompt to the mobile device.

12. The method of claim 11 wherein the request includes an identification of the mobile device.

13. The method of claim 12 further comprising determining a permission for the mobile device.

14. The method of claim 9 further comprising determining a permission for the user.

15. The method of claim 9 wherein the claimant response to the second prompt is received over the first communication channel.

16. The method of claim 9 wherein the claimant response to the second prompt is received over a second communication channel.

17. The method of claim 9 wherein the claimant response is a biometric response.

18. A system comprising:

a computing system including logic, including a microprocessor, programmed to

send a first prompt for a claimant target,

receive the claimant target,

send a second prompt over a first communication channel;

receive a claimant response to the second prompt;

determine a match between the claimant response and a response template associated with the second prompt; and

send a decryption key after determining the match between the claimant response and a response template.

19. The system of claim 18 wherein the computing system includes logic further programmed to select the second prompt from a plurality of prompts.

20. The system of claim 18 wherein the computing system includes logic further programmed to store the response template in association with the second prompt.

21. The system of claim 18 wherein the computing system includes logic further programmed to determine a permission for the user.

22. The system of claim 18 wherein the computing system includes logic further programmed to determine a permission for the mobile device.