Content item encryption on mobile devices

Patent metadata

Field	Value
Publication number	US-9405925-B2
Application number	US-201414176143-A
Country	US
Kind code	B2
Filing date	Feb 9, 2014
Priority date	Feb 9, 2014
Publication date	Aug 2, 2016
Grant date	Aug 2, 2016

Abstract

Applications are stored on removable storage of a mobile device in an encrypted form to provide isolation and piracy protection. In one implementation, each application is encrypted using its own associated encryption key that is generated based on an identifier of the application and a master key that is associated with a trusted platform module of the mobile device. In another implementation, each application is encrypted using two associated encryption keys. One key is used to encrypt binary data associated with the application such as source code, and the other key is used to encrypt application data such as graphics and configuration files. The encryption keys are each generated using the identifier of the application, the master key, and identifiers of the folders where the corresponding data types are stored on the mobile device. The removable storage includes SD cards formatted using the FAT or exFAT file systems.

First claim

What is claimed:

1. A method comprising:
receiving, from an operating system, a request to read encrypted data associated with a content item by a file manager executed by a mobile device, the encrypted data stored in removable storage of the mobile device;
determining whether the request to read the encrypted data is authorized by the mobile device;
based at least on a determination that the request to read the encrypted data is authorized, determining a key associated with the content item by the mobile device, the key stored in a region of non-removable storage of the mobile device, wherein determining the key associated with the content item comprises determining the region of the non-removable storage associated with the mobile device, and retrieving the key from the region of the non-removable storage associated with the mobile device;
decrypting the encrypted data associated with the content item using the key by the mobile device to generate decrypted data; and
providing the decrypted data to the operating system by the file manager executed by the mobile device.

2. The method of claim 1 , wherein the removable storage comprises a secure digital card.

3. The method of claim 1 , wherein the encrypted data is stored on the removable storage in at least one of the file allocation table system or extended file allocation table file system.

4. The method of claim 1 , wherein the content item comprises one or more of an application, a video content item, or an audio content item.

5. The method of claim 1 , wherein determining a key associated with the content item comprises determining a master key associated with the mobile device and determining the key associated with the content item based on the master key and an identifier associated with the content item.

6. The method of claim 5 , wherein the master key is signed by a trusted platform module associated with the mobile device.

7. The method of claim 1 , wherein determining a key associated with the content item comprises retrieving the key from a cache associated with the content item using an identifier associated with the content item.

8. A method comprising:
receiving, from an operating system, a request to read encrypted data associated with a content item by a file manager executed by a mobile device, the encrypted data stored in removable storage of the mobile device;
determining a key associated with the content item by the mobile device, the key stored in a region of non-removable storage of the mobile device, wherein determining the key associated with the content item comprises determining the region of the non-removable storage associated with the mobile device, and retrieving the key from the region of the non-removable storage associated with the mobile device;
decrypting the encrypted data associated with the content item using the key by the mobile device to generate decrypted data; and
providing the decrypted data to the operating system by the file manager executed by the mobile device.

9. The method of claim 8 , wherein the removable storage comprises a secure digital card.

10. The method of claim 8 , wherein the encrypted data is stored on the removable storage in at least one of the file allocation table system or extended file allocation table file system.

11. The method of claim 8 , wherein the content item comprises one or more of an application, a video content item, or an audio content item.

12. The method of claim 8 , wherein determining a key associated with the content item comprises determining a master key associated with the mobile device and determining the key associated with the content item based on the master key and an identifier associated with the content item.

13. The method of claim 12 , wherein the master key is signed by a trusted platform module associated with the mobile device.

14. The method of claim 8 , wherein determining a key associated with the content item comprises retrieving the key from a cache associated with the content item using an identifier associated with the content item.

15. A system comprising:
removable storage;
non-removable storage; and
a file manager configured to:
receive a request to read encrypted data associated with a content item, the data stored in the removable storage;
determine whether the request to read the encrypted data is authorized;
based at least on a determination that the request to read the encrypted data is authorized, determine a key associated with the content item, the key stored in the non-removable storage, wherein determining the key associated with the content item comprises determining the region of the non-removable storage, and retrieving the key from the region of the non-removable storage;
decrypt the encrypted data associated with the content item using the key to generate decrypted data; and
provide the decrypted data.

16. The system of claim 15 , wherein the removable storage comprises a secure digital card.

17. The system of claim 15 , wherein the content item is one or more of an application, a video content item, or an audio content item.

18. The system of claim 15 , wherein the system comprises at least one of a cell phone or a tablet computer.

Assignees

• Microsoft Corp
• Microsoft Technology Licensing Llc

Inventors

• Callaghan David
• Pudipeddi Ravisankar
• Olsen Geir
• Patel Sachin
• Zhou Jianming
• D'Silva Dylan

Classifications

• G06F21/10 Primary

  Protecting distributed programs or content, e.g. vending or licensing of copyrighted material (protection in video systems or pay television H04N7/16) {; Digital rights management [DRM]} · CPC title

• G06F2221/0704

  Physics · mapped topic

• G06F21/6218 Primary

  to a system of files or objects, e.g. local or distributed file system or database · CPC title

• G06F21/1011 Primary

  to devices · CPC title