Systems and methods for secure storage on a mobile device

• US 9,058,503 B2
• Filed: 05/10/2013
• Issued: 06/16/2015
• Est. Priority Date: 05/10/2013
• Status: Active Grant

• Current Assignee: Successfactors Incorporated (SAP SE)
• Original Assignee: Successfactors Incorporated (SAP SE)
• Inventors: Bernaudin, Ingrid, Yu, Mei, Dunn, Angus
• Primary Examiner(s): Barron, Jr., Gilberto
• Assistant Examiner(s): Cribbs, Malcolm
• Application Number:
  US13/892,048
• Publication Number:
  US 20140337638A1
• Time in Patent Office: 767 Days
• Field of Search: None
• US Class Current: 1/1
• CPC Class Codes: G06F 21/6209 to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 21/629 to features or functions of an application

Abstract

In one embodiment the present invention includes a computer-implemented method for a mobile device. An application security status is detected. When the application security status is active an application passcode is required to access functionality of a mobile application operating on the mobile device. A first encryption of data associated with the mobile application is performed, where the first encryption uses a first encryption key when the application security status is active, and the first encryption uses a second encryption key when the application security status is not active. A mobile device passcode status is detected. When the mobile device passcode status is active a mobile device passcode is required to access functionality of the mobile computing device. A second encryption of the data is performed when the mobile device passcode status is active, where the second encryption uses a third encryption key.

Claims

1. A computer-implemented method comprising:

detecting, on a mobile computing device, an application security status, wherein when the application security status is active an application passcode is required to access functionality of a mobile application operating on the mobile computing device;

performing, on the mobile computing device, a first encryption of data associated with the mobile application, wherein the first encryption uses a first encryption key when the application security status is active, and wherein the first encryption uses a second encryption key when the application security status is not active;

detecting, on the mobile computing device, a mobile device passcode status, wherein when the mobile device passcode status is active a mobile device passcode is required to access functionality of the mobile computing device; and

performing, on the mobile computing device, a second encryption of the data when the mobile device passcode status is active, wherein the second encryption uses a third encryption key.

2. The method of claim 1 wherein the first encryption key is derived from the application passcode.

3. The method of claim 1 wherein the second encryption key is a randomly generated key produced by the mobile application.

4. The method of claim 1 wherein the third encryption key is derived from the mobile passcode.

5. The method of claim 1 further comprising storing the encrypted data in a storage location that is accessible only by the mobile application.

6. The method of claim 1 wherein the first encryption produces encrypted data and the second encryption encrypts the encrypted data.

7. The method of claim 1 wherein the mobile application stores a plurality of data in a storage system accessible only by the mobile application, and wherein said first encryption is performed on a predefined subset of the plurality of data in the storage system, and wherein the second encryption is performed on the plurality of data in the storage system.

8. The method of claim 1 further comprising:

sending, by the mobile application, a request for data to a remote server;

receiving, by the mobile application, requested data;

performing, by the mobile application, an instruction to store the requested data with a flag indicating the requested data is to be encrypted; and

automatically encrypting and storing the requested data in response to the instruction.

9. A mobile computing device comprising:

a processor; and

a non-transitory computer readable medium having stored thereon one or more programs, which when executed by the processor, causes the processor to;

detect an application security status, wherein when the application security status is active an application passcode is required to access functionality of a mobile application operating on the mobile computing device;

perform a first encryption of data associated with the mobile application, wherein the first encryption uses a first encryption key when the application security status is active, and wherein the first encryption uses a second encryption key when the application security status is not active;

detect a mobile device passcode status, wherein when the mobile device passcode status is active a mobile device passcode is required to access functionality of the mobile computing device; and

perform a second encryption of the data when the mobile device passcode status is active, wherein the second encryption uses a third encryption key.

10. The mobile computing device of claim 9 wherein the first encryption key is derived from the application passcode.

11. The mobile computing device of claim 9 wherein the second encryption key is a randomly generated key produced by the mobile application.

12. The mobile computing device of claim 9 wherein the third encryption key is derived from the mobile passcode.

13. The mobile computing device of claim 9 wherein the first encryption produces encrypted data and the second encryption encrypts the encrypted data.

14. The mobile computing device of claim 9 wherein the mobile application stores a plurality of data in a storage system accessible only by the mobile application, and wherein said first encryption is performed on a predefined subset of the plurality of data in the storage system, and wherein the second encryption is performed on the plurality of data in the storage system.

15. A non-transitory computer readable storage medium storing one or more programs, the one or more programs comprising instructions for:

detecting an application security status, wherein when the application security status is active an application passcode is required to access functionality of a mobile application operating on a mobile computing device;

performing a first encryption of data associated with the mobile application, wherein the first encryption uses a first encryption key when the application security status is active, and wherein the first encryption uses a second encryption key when the application security status is not active;

detecting a mobile device passcode status, wherein when the mobile device passcode status is active a mobile device passcode is required to access functionality of the mobile computing device; and

performing a second encryption of the data when the mobile device passcode status is active, wherein the second encryption uses a third encryption key.

16. The non-transitory computer readable storage medium of claim 15 wherein the first encryption key is derived from the application passcode.

17. The non-transitory computer readable storage medium of claim 15 wherein the second encryption key is a randomly generated key produced by the mobile application.

18. The non-transitory computer readable storage medium of claim 15 wherein the third encryption key is derived from the mobile passcode.

19. The non-transitory computer readable storage medium of claim 15 wherein the first encryption produces encrypted data and the second encryption encrypts the encrypted data.

20. The non-transitory computer readable storage medium of claim 15 wherein the mobile application stores a plurality of data in a storage system accessible only by the mobile application, and wherein said first encryption is performed on a predefined subset of the plurality of data in the storage system, and wherein the second encryption is performed on the plurality of data in the storage system.