Trusted UI that derives encryption keys from user input inside a secure enclave
The patent describes a mobile-device mechanism that forwards file access to a secure environment, instantiates a trusted user interface (TUI) inside that environment, collects user input through the TUI, derives an encryption/decryption key from the input within the secure environment, and uses that key to encrypt or decrypt sensitive files on the device. The intended users are device OEMs or app platforms that need to protect local files and keys from untrusted applications on mobile devices.
(57) What the patent covered
This write-up was generated by AI from the patent's text and may contain mistakes, so check it against the original patent before relying on it.
The main independent claim covers receiving an encrypt/decrypt request, forwarding a file access request to a secure environment on the mobile device, instantiating a trusted user interface, collecting user input via the TUI inside the secure environment, generating a key from that input inside the secure environment, and performing encryption or decryption of the sensitive data using that key on the mobile device.
Distinguishing feature: Placing the TUI, user input capture, key derivation and file cryptographic operations all inside the device's secure environment and routing file access requests there.
Novelty 3/5. Secure enclaves and on-device encryption were known; the patent focuses on integrating a TUI-driven key derivation and routing file access into the secure environment, which is a practical improvement rather than a new class of system.
Implementation
A small team would implement this using a mobile TEE (ARM TrustZone or Android Keystore TEE): add a trusted UI app in the TEE to present input fields and capture touch events via a secure display path or compositor, implement an IPC/file-proxy shim in the normal OS that forwards file access requests to the TEE service, run key-derivation and encryption/decryption code inside the TEE using the collected input, and store or stream encrypted blobs to normal-world storage. Use existing KDFs (PBKDF2, Argon2) and standard AES-GCM for file encryption and integrate with platform boot/auth flows as needed.
Components: Secure environment / trusted execution environment (TEE) runtime (e.g., TrustZone or SEV), Trusted user interface component that can render and capture input from display/touch, Key-derivation logic (KDF) executed inside the TEE, File I/O proxy that forwards file access requests from normal world to TEE.
Buildability 5/5. Engineering challenges are mostly integration: secure display/input paths, TEE APIs and platform-specific file forwarding; no custom hardware required.
Market demand
No demand check has been run for this patent. Likely search terms: trusted user interface file encryption, TEE derived key file protection, secure enclave file access proxy. The links in the sidebar open these searches.
Buyers: Mobile OEMs, OS platform security teams, enterprise MDM vendors.
Before manufacturing
No related continuation or divisional patents in force were found. Design patents, trademarks and unrelated patents may still cover the product.
Practical risks include platform-dependent TEE capabilities and secure display/input support, user experience friction, and overlap with existing platform key-protection features and third-party patents.
About 1.5% of lapsed patents are later revived by their owners. This page is a research lead, not legal advice. Obtain a freedom-to-operate opinion before manufacturing.