SYSTEM AND METHOD FOR PERFORMING A SECURE CRYPTOGRAPHIC OPERATION ON A MOBILE DEVICE
In a mobile communication device, multiple sets of sensor measurement data are obtained, each from a corresponding hardware sensor resident on the device. Insufficiently random data is filtered from each of the data sets to produce random data sets which are combined to produce entropy data which is stored in an entropy data cache. An entropy pool is monitored to determine a level of entropy data available and, based on the level determined, entropy data is provided from the entropy data cache to the entropy pool. Entropy data from the entropy pool is then applied to perform a cryptographic operation such as the generation of an encryption key for encrypting communications sent or received by the mobile communication device.
1 . A method of performing a secure cryptographic operation, the method performed by a mobile communication device and comprising the steps of:
obtaining multiple sets of sensor measurement data, each being obtained from a corresponding one of multiple hardware sensors resident on the mobile communication device;
filtering insufficiently random data from each of the multiple sets of sensor measurement data to provide a corresponding one of multiple sets of random source data;
combining the multiple sets of random source data to produce entropy data;
storing the entropy data in an entropy data cache;
monitoring an entropy pool to determine a level of entropy data available;
providing, based on the level determined, entropy data from the entropy data cache to the entropy pool; and
applying the entropy data from the entropy pool to perform a cryptographic operation.
2 . The method of claim 1 , wherein the step of applying the entropy data comprises providing the entropy data to seed a pseudorandom number generator.
3 . The method of claim 1 , wherein the step of applying the entropy data comprises providing the entropy data to a cryptographic module.
4 . The method of claim 1 , wherein the step of applying the entropy data to perform a cryptographic operation comprises applying the entropy data to encrypt data communicated over the mobile communication device.
5 . The method of claim 1 , wherein the step of obtaining multiple sets of sensor measurement data comprises obtaining data from an inertial data sensor.
6 . The method of claim 1 , wherein the step of obtaining multiple sets of sensor measurement data comprises obtaining a first set of sensor measurement data from an inertial data sensor and a second set of sensor measurement data from an ambient light sensor.
7 . A mobile communication device configured for performing a secure cryptographic operation, comprising:
multiple hardware sensors, each generating one of correspondingly multiple sets of sensor measurement data,
an entropy management module obtaining the multiple sets of sensor measurement data from the multiple hardware sensors, filtering insufficiently random data from each of the multiple sets of sensor measurement data to provide a corresponding one of multiple sets of random source data, and combining the multiple sets of random source data to produce entropy data;
an entropy data cache storing the entropy data after combination;
an entropy pool for storing entropy data available for use in performing a cryptographic operation;
the entropy management module monitoring the entropy pool to determine a level of entropy data available and providing, based on the level determined, entropy data from the entropy data cache to the entropy pool.
8 . The method of claim 7 , further comprising a pseudorandom number generator, and wherein the entropy data stored in the entropy pool is applied to seed the pseudorandom number generator.
9 . The method of claim 7 , further comprising a cryptographic module, and wherein the entropy data stored in the entropy pool is applied to the cryptographic module.
10 . The method of claim 7 , further comprising an encryption key generator which applies the entropy data stored in the entropy pool to encrypt data communicated over the mobile communication device.
11 . The method of claim 7 , wherein the multiple hardware sensors include one or more inertial measurement sensors.
12 . The method of claim 7 , wherein the multiple hardware sensors include one or more inertial measurement sensors, and one or more ambient light sensors.