Granted Patent B2

US 7,529,374 · App. 10/356,527 · Granted May 5, 2009

Abstract

Claims (39)

1. A method of securing data stored on an electronic device whereby access to the secured data requires entry of a user passphrase, the method comprising:

encrypting the data using a symmetric cipher and a corresponding symmetric key (KEY tmp ) which is accessible without the need for the user passphrase, storing the encrypted data and destroying the unencrypted data;

protecting the symmetric key (KEYtmp) by encrypting the symmetric key (KEY tmp ) with the public key (KEY pub ) of a public/private key pair;

destroying a plaintext form of the symmetric key (KEY tmp ), whilst storing the encrypted symmetric key (KEY tmp ); and

protecting the private key (KEY priv ) of the public/private key pair with a second symmetric key (KEY sym ), the second symmetric key (KEY tmp ) being encrypted with said user passphrase or with a key being derivable therefromderived from said user passphrase,

wherein immediately following the encryption of the data, the unencrypted key (KEY tmp ) is unavailable to the device until the user passphrase is subsequently available to the device.

2. A method according to claim 1 and comprising selecting said symmetric key (KEY tmp ) from a set of symmetric keys stored in a memory of the device.

3. A method according to claim 2 and comprising storing said set of symmetric keys in plaintext form in a memory of the device, together with encrypted versions of the same keys protected using said user passphrase.

4. A method according to claim 1 and comprising dynamically generating said symmetric key (KEY tmp ) when it is required to encrypt data.

5. A method of securing data stored on an electronic device whereby access to the secured data requires entry of a user passphrase, the method comprising:

encrypting the data using a symmetric cipher and a corresponding symmetric key (KEY tmp ) which is accessible without the need for the user passphrase, storing the encrypted data and destroying the unencrypted data;

protecting the symmetric key (KEY tmp ) by encrypting the symmetric key with the public key (KEY pub ) of a public/private key pair;

destroying a plaintext form of the symmetric key, whilst storing the encrypted symmetric key (KEY tmp ); and

protecting the private key (KEY priv ) of the public/private key pair by encrypting it with said user passphrase,

wherein immediately following the encryption of the data, the unencrypted symmetric key (KEY tmp ) is unavailable to the device until the user passphrase is subsequently available to the device.

6. A method according to claim 5 and comprising selecting said symmetric key (KEY tmp ) from a set of symmetric keys stored in a memory of the device.

7. A method according to claim 6 and comprising storing said set of symmetric keys in plaintext form in a memory of the device, together with encrypted versions of the same keys protected using said user passphrase.

8. A method according to claim 5 and comprising dynamically generating said symmetric key (KEY tmp ) when it is required to encrypt data.

9. A method of securing data stored on an electronic device whereby access to the secured data requires entry of a user passphrase, the method comprising:

encrypting the data using a symmetric cipher and a corresponding symmetric key (KEY tmp ) which is accessible without the need for the user passphrase, storing the encrypted data and destroying the unencrypted data;

protecting the symmetric key (KEY tmp ) with a second symmetric key (KEY sym ), the second symmetric key being encrypted with said user passphrase or a key derived from said user passphrase; and

destroying a plaintext form of the symmetric key (KEY tmp ), whilst storing the encrypted symmetric key (KEY tmp ),

wherein immediately following the encryption of the data, the unencrypted symmetric key (KEY tmp ) is unavailable to the device until the user passphrase is subsequently available to the device.

10. A method according to claim 9 and comprising selecting said symmetric key (KEY tmp ) from a set of symmetric keys stored in a memory of the device.

11. A method according to claim 10 and comprising storing said set of symmetric keys in plaintext form in a memory of the device, together with encrypted versions of the same keys protected using said user passphrase.

12. A method according to claim 9 and comprising dynamically generating said symmetric key (KEY tmp ) when it is required to encrypt data.

13. A method of securing data on an electronic device and comprising:

allowing a user of the device to select one of an encryption and decryption operating mode and an encryption only operating mode,

wherein said encryption only mode comprises encrypting the data using a symmetric cipher and a corresponding symmetric key (KEY tmp ) which is accessible without the need for the user passphrase, storing the encrypted data, destroying the unencrypted data, and encrypting and storing the symmetric key (KEY tmp ) whilst destroying a plaintext form of the symmetric key, whilst storing the symmetric key (KEY tmp ),

wherein said encryption and decryption mode encrypts data using a symmetric key (KEY tmp ), that symmetric key being encrypted with a second symmetric key (KEY sym ), the second symmetric key (KEY tmp ) being encrypted with said user passphrase or with a key derived from said user passphrase, and

wherein immediately following the encryption of the data, the unencrypted key (KEY tmp ) is unavailable to the device until the passphrase is subsequently available to the device

wherein the encryption and decryption operating mode requires that the device have access to a user passphrase, and the encryption only operating mode does not require that the device have access to the user passphrase.

14. An electronic device, comprising:

hardware and software for causing the device to operate in one of two operating modes, an encryption and decryption operating mode and an encryption only operating mode, the encryption and decryption operating mode requiring that the device have access to a user passphrase, and the encryption only operating mode does not require that the device have access to the user passphrase,

generating means for generating a symmetric key (KEY sym ) in a memory of the device, wherein a private key (KEY priv ) of a public/private key pair is encrypted with the symmetric key (KEY sym ), and the symmetric key (KEY sym ) is encrypted with said user passphrase or generated from said user passphrase using said generating means; and

encryption means for

when said device is in said encryption only operating mode, encrypting data using a temporary key (KEY tmp ), the key (KEY tmp ) is encrypted using the public key (KEY pub ) of the public/private key pair

when said device is in said encryption and decryption operating mode, encrypting said data using a temporary key (KEY tmp ) and encrypting the temporary key (KEY tmp ) using a symmetric key (KEY sym ) which is secured using said user passphrase;

wherein, when said device is in said encryption and decryption operating mode, access to the user passphrase enables data encrypted in both modes to be decrypted.

Assignments (6)