Private key protection for mobile security and privacy

私钥保护，保障移动安全和隐私

• 批准号: 483794-2015
• 负责人: Adams, Carlisle
• 金额: $ 1.82万
• 依托单位: University of Ottawa
• 依托单位国家: 加拿大
• 项目类别: Engage Grants Program
• 财政年份: 2015
• 资助国家: 加拿大
• 起止时间: 2015-01-01 至 2016-12-31
• 项目状态: 已结题
• 来源: https://www.nserc-crsng.gc.ca/ase-oro/Details-Detailles_eng.asp?id=583919
• 关键词: Private; key; protection; mobile; security

Mobile devices and tablets are often used by patients, doctors, and other health care providers to access, update,and manage healthcare data. However, recent reports suggest that the vast majority of the global volume of mobile data is not secured, and the number of known mobile malware programs has grown to over 175K in 2014. Furthermore, because healthcare data is accessed by multiple different parties, a secure system is required to not only enable this access, but also provide granular, auditable access. This project proposes a physical and logical separation of encryption keys and healthcare data, where private keys are not stored on the device with the data but are generated on an as-needed basis, thus removing the requirement for a secure element on the device to store the key. The research challenge is to develop a scheme to generate private keys securely and efficiently on a mobile device any time this is required in order to facilitate efficient end-to-end encryption and access control of the device data.

移动的设备和平板电脑通常被患者、医生和其他医疗保健提供者用于访问、更新和管理医疗保健数据。然而，最近的报告表明，全球移动的数据量的绝大多数是不安全的，并且已知的移动的恶意软件程序的数量在2014年已经增长到超过175K。此外，由于医疗保健数据由多个不同的方访问，因此需要一个安全的系统，不仅可以实现这种访问，而且还可以提供粒度，可审计的访问。 该项目提出了加密密钥和医疗保健数据的物理和逻辑分离，其中私钥不与数据一起存储在设备上，而是根据需要生成，从而消除了设备上存储密钥的安全元件的要求。研究挑战是开发一种方案，以便在需要时随时在移动终端上安全有效地生成私钥，以促进设备数据的高效端到端加密和访问控制。