Patent Description:
Various electronic devices such as smart phones, tablet Personal Computers (PCs), Portable Multimedia Players (PMPs), Personal Digital Assistants (PDAs), laptop PCs, and wearable devices have been distributed.

Various electronic devices may demand user authentication in order to provide a variety of functions which the electronic device can provide. The electronic device may receive information for user authentication input by a user and compare the information for the user authentication with information configured by the user, so as to perform the user authentication. The electronic device may provide a variety of functions which the electronic device can provide according to the result of the user authentication.

For example, the electronic device may perform user authentication through an operation of receiving a password input by the user to perform user authentication and comparing the input password with a password conventionally configured by the user. The password input by the user may be data implemented by a combination of letters/numbers or data implemented by user's biometric information (for example, a user's fingerprint, a user's iris, or user's face information). A plurality of modules (for example, various modules including a module for file encryption or a module for switching to an unlocking mode) demanding a password may be implemented in an electronic device, and the plurality of modules may receive a password input by the user and transmit the received password to a password processing module in order to verify the password. The password processing module may transmit the result of verifying the received password to a plurality of modules, and the plurality of modules may determine whether to activate various functions on the basis of the verification result. <CIT> relates to portable storage. The storage includes a plurality of authentication modules that perform mutual authentication using different mutual authentication algorithms; a control module that controls the authentication modules so that any one among the authentication modules can perform mutual authentication work with a host device through the DRM system identifier extracted from an authentication-request message received from the host device; and an object-management module that protects communication with the host device using a generated session key as a result of the mutual authentication. <CIT> relates to a method of encrypting data transmitted from a first device to a second device, performed by using an Advanced Encryption Standard (AES) encryption algorithm, includes obtaining size information of an encryption key and size information of data that is to be encrypted and includes a plurality of bits; encrypting a first bit group, which is at least one bit corresponding to a size of the encryption key, among the plurality of bits, by using the encryption key; selecting a third bit group, which is at least one bit of the encrypted first bit group based on size information of the encryption key and a size of a second bit group including bits that are different from the first bit group among the plurality of bits; and encrypting the second bit group and the selected third bit group by using the encryption key. <CIT> relates to a method for personalizing a secure processor in a NFC system to execute a secure application, comprising steps of obtaining by a server identification data of a user memorized in a secure storage medium, personalization data corresponding to the user identification data, and identification data of a NFC system of the user, comprising an encryption key of the secure processor, encrypting by the server personalization data using the encryption key, transmitting to the NFC system encrypted personalization data, receiving by the secure processor encrypted personalization data, deciphering personalization data, and memorizing in a secured way personalization data by the secure processor. <CIT> relates to protected content distribution that is accomplished by a first entity generating a set of asymmetric key pairs, creating a plurality of sets of private keys by selecting a combination of private keys from the set of asymmetric key pairs for each created set, and distributing the sets of private keys to playback devices. A second entity produces protected content including encrypted content and a public key media key block, encrypts a symmetric content key with each public key in the set of asymmetric key pairs to form the public key media key block and encrypts a content title with the symmetric content key to form the encrypted content. A playback device stores one set of private keys, receives the protected content, and decrypts and plays the content title stored in the protected content when a selected one of the set of private keys stored by the playback device successfully decrypts the encrypted symmetric content key stored in the public key media key block of the received protected content.

In a process in which a password input by a user is transferred to a password processing module for processing a password, the password may be copied several times in the transferring process and the copied password may exist in a partial area of a memory. The password existing in the partial area of the memory may be exposed to an attacker who acquires authority for accessing the memory, and thus security may be compromised.

An electronic device according to various embodiments of the disclosure includes: a user interface; a processor operatively connected to the user interface; and a memory operatively connected to the processor and including a normal area and a secure area, wherein the memory configured to store a plurality of keys for encrypting data corresponding to a user input and store instructions causing the processor, when executed, receive the data through the user interface, nontemporarily store the received data in the normal area, identify an information quantity of the stored data, select at least one of the plurality of keys stored in the memory, based on at least a portion of the identified information quantity, encrypt the data using the selected key, and transmit the encrypted data and information indicating the selected key to the secure area which demands access authority.

A method of operating an electronic device according to various embodiments of the disclosure includes: receiving data corresponding to a user input through a user interface; nontemporarily storing the received data in a normal area of a memory; identifying an information quantity of the stored data; selecting one of a plurality of keys stored in the memory, based on at least a portion of the information quantity of the data; encrypting the data by using the selected key; and transmitting the encrypted data and information indicating the selected key to a secure area which demands access authority.

An electronic device and a method of operating an electronic device according to various embodiments of the disclosure can improve security of the electronic device by encrypting input data, transmitting the encrypted data to a secure area, and deleting data existing in a normal area.

An electronic device and a method of operating an electronic device according to various embodiments of the disclosure can improve security of data since encrypted data is exposed even though data transmitted/received within the electronic device is exposed to an attacker.

An electronic device and a method of operating an electronic device according to various embodiments of the disclosure can select a size of a key to be used for encryption of data on the basis of an information quantity of the input data, so as to prevent decline of encryption speed generated by encryption of data having a small information quantity of data using a key having an excessively large size and increase the encryption speed.

In connection with description of drawings, the same or similar reference numerals may be used for the same or similar elements.

<FIG> is a block diagram <NUM> illustrating the program <NUM> according to various embodiments. According to an embodiment, the program <NUM> may include an operating system (OS) <NUM> to control one or more resources of the electronic device <NUM>, middleware <NUM>, or an application <NUM> executable in the OS <NUM>. The OS <NUM> may include, for example, AndroidTM, iOSTM, WindowsTM, SymbianTM, TizenTM, or BadaTM. At least part of the program <NUM>, for example, may be preloaded on the electronic device <NUM> during manufacture, or may be downloaded from or updated by an external electronic device (e.g., the electronic device <NUM> or <NUM>, or the server <NUM>) during use by a user.

The OS <NUM> may control management (e.g., allocating or deallocation) of one or more system resources (e.g., process, memory, or power source) of the electronic device <NUM>. The OS <NUM>, additionally or alternatively, may include one or more driver programs to drive other hardware devices of the electronic device <NUM>, for example, the input device <NUM>, the sound output device <NUM>, the display device <NUM>, the audio module <NUM>, the sensor module <NUM>, the interface <NUM>, the haptic module <NUM>, the camera module <NUM>, the power management module <NUM>, the battery <NUM>, the communication module <NUM>, the subscriber identification module <NUM>, or the antenna module <NUM>.

The middleware <NUM> may provide various functions to the application <NUM> such that a function or information provided from one or more resources of the electronic device <NUM> may be used by the application <NUM>. The middleware <NUM> may include, for example, an application manager <NUM>, a window manager <NUM>, a multimedia manager <NUM>, a resource manager <NUM>, a power manager <NUM>, a database manager <NUM>, a package manager <NUM>, a connectivity manager <NUM>, a notification manager <NUM>, a location manager <NUM>, a graphic manager <NUM>, a security manager <NUM>, a telephony manager <NUM>, or a voice recognition manager <NUM>.

The application manager <NUM>, for example, may manage the life cycle of the application <NUM>. The window manager <NUM>, for example, may manage one or more graphical user interface (GUI) resources that are used on a screen. The multimedia manager <NUM>, for example, may identify one or more formats to be used to play media files, and may encode or decode a corresponding one of the media files using a codec appropriate for a corresponding format selected from the one or more formats. The resource manager <NUM>, for example, may manage the source code of the application <NUM> or a memory space of the memory <NUM>. The power manager <NUM>, for example, may manage the capacity, temperature, or power of the battery <NUM>, and determine or provide related information to be used for the operation of the electronic device <NUM> based at least in part on corresponding information of the capacity, temperature, or power of the battery <NUM>. According to an embodiment, the power manager <NUM> may interwork with a basic input/output system (BIOS) (not shown) of the electronic device <NUM>.

The database manager <NUM>, for example, may generate, search, or change a database to be used by the application <NUM>. The package manager <NUM>, for example, may manage installation or update of an application that is distributed in the form of a package file. The connectivity manager <NUM>, for example, may manage a wireless connection or a direct connection between the electronic device <NUM> and the external electronic device. The notification manager <NUM>, for example, may provide a function to notify a user of an occurrence of a specified event (e.g., an incoming call, message, or alert). The location manager <NUM>, for example, may manage locational information on the electronic device <NUM>. The graphic manager <NUM>, for example, may manage one or more graphic effects to be offered to a user or a user interface related to the one or more graphic effects.

The security manager <NUM>, for example, may provide system security or user authentication. The telephony manager <NUM>, for example, may manage a voice call function or a video call function provided by the electronic device <NUM>. The voice recognition manager <NUM>, for example, may transmit a user's voice data to the server <NUM>, and receive, from the server <NUM>, a command corresponding to a function to be executed on the electronic device <NUM> based at least in part on the voice data, or text data converted based at least in part on the voice data. According to an embodiment, the middleware <NUM> may dynamically delete some existing components or add new components. According to an embodiment, at least part of the middleware <NUM> may be included as part of the OS <NUM> or may be implemented as another software separate from the OS <NUM>.

The application <NUM> may include, for example, a home <NUM>, dialer <NUM>, short message service (SMS)/multimedia messaging service (MMS) <NUM>, instant message (IM) <NUM>, browser <NUM>, camera <NUM>, alarm <NUM>, contact <NUM>, voice recognition <NUM>, email <NUM>, calendar <NUM>, media player <NUM>, album <NUM>, watch <NUM>, health <NUM> (e.g., for measuring the degree of workout or biometric information, such as blood sugar), or environmental information <NUM> (e.g., for measuring air pressure, humidity, or temperature information) application. According to an embodiment, the application <NUM> may further include an information exchanging application (not shown) that is capable of supporting information exchange between the electronic device <NUM> and the external electronic device. The information exchange application, for example, may include a notification relay application adapted to transfer designated information (e.g., a call, message, or alert) to the external electronic device or a device management application adapted to manage the external electronic device. The notification relay application may transfer notification information corresponding to an occurrence of a specified event (e.g., receipt of an email) at another application (e.g., the email application <NUM>) of the electronic device <NUM> to the external electronic device. Additionally or alternatively, the notification relay application may receive notification information from the external electronic device and provide the notification information to a user of the electronic device <NUM>.

The device management application may control the power (e.g., turn-on or turn-off) or the function (e.g., adjustment of brightness, resolution, or focus) of the external electronic device or some component thereof (e.g., a display device or a camera module of the external electronic device). The device management application, additionally or alternatively, may support installation, delete, or update of an application running on the external electronic device.

<FIG> is a block diagram of an electronic device <NUM> according to various embodiments of the disclosure.

The electronic device <NUM> according to various embodiments of the disclosure (for example, the electronic device <NUM> of <FIG>) may include a user interface <NUM>, a memory <NUM> (for example, the memory <NUM> of <FIG>), and a processor <NUM> (for example, the processor <NUM> of <FIG>).

According to various embodiments of the disclosure, the user interface <NUM> may receive a user input corresponding to data to be encrypted on the basis of the control of the processor <NUM>. The user input may be a user input of inputting a password for various functions which can be provided by the electronic device <NUM>. For example, the user input may be a user input of inputting a password for switching a locked state in which at least some functions are deactivated to an unlocked state in which at least some functions are activated. The password may be data implemented by a combination of letters/numbers, data implemented by pattern information in various forms which can be input into a display, data implemented by user's biometric information (for example, various pieces of biometric information including a user's fingerprint, iris, or face), or data in various type which can be implemented in the future.

According to various embodiments of the disclosure, the user interface <NUM> may be implemented in various forms for receiving a user input. For example, the user interface <NUM> may be implemented as a display. The display may display various screens on the basis of the control of the processor <NUM> and receive a user input on the display. The display may receive a user input corresponding to data to be encrypted. The display may display a screen for inputting a user input on the basis of the control of the processor <NUM>, receive the user input in the state in which the screen is displayed, and transmit data corresponding to the user input to the processor <NUM>.

In another example, the user interface <NUM> may be a sensor module capable of acquiring user's biometric information. The user interface <NUM> may be implemented in the form of a fingerprint recognition sensor capable of acquiring user's fingerprint information in various types (for example, ultrasonic type or capacitive type), an infrared camera capable of acquiring user's iris information, and a Time of Flight (ToF) camera capable of acquiring user's face information.

According to various embodiments of the disclosure, the memory <NUM> may temporarily or nontemporarily store various pieces of data. The memory <NUM> may transmit the temporarily or nontemporarily stored data to the processor <NUM>. The memory <NUM> may store one or more keys which can be used for encryption of data corresponding to a user input and transmit the keys stored in the memory <NUM> to the processor <NUM> in response to a request from the processor <NUM>.

According to various embodiments of the disclosure, the processor <NUM> may encrypt the data corresponding to the user input and transmit the encrypted data to a secure area. The data corresponding to the user input may be temporarily stored in a normal area. The secure area may be an area which can be accessed in the case in which there is specific authority (for example, authority of access to the secure area or authority of correction of data stored in the secure area). The normal area may be an area which can be accessed without any specific authority. The normal area and the secure area can be implemented in the processor <NUM> or the memory <NUM>.

According to various embodiments of the disclosure, the processor <NUM> may encrypt the data corresponding to the user input through various encryption schemes (for example, various encryption schemes including an RSA encryption algorithm and an Elliptic Curve Integrated Encryption Scheme (ECIES) algorithm).

According to various embodiments of the disclosure, the processor <NUM> may differently select a key to be used for encryption of the input data according to an information quantity of the input data. The information quantity of the data may be entropy of data which is an actual security secret value of the input data (value indicating a security strength according to the length of data).

For example, when it is assumed that the input data (for example, <NUM>) is data of a five-digit number including only numbers, the total number of pieces of data which can be implemented in every digit is <NUM>, that is, <NUM> to <NUM>, and thus the information quantity of the input data may be <NUM><NUM>. In another example, when it is assumed that the input data (for example, AaBbC) is data of a five-digit number including only letters, the total number of data which can be implemented in one digit is <NUM>, that is, A to Z and a to z, and thus the information quantity of the input data may be <NUM><NUM>. In another example, when it is assumed that the input data (for example, aAbC45) is data of a six-digit number including letters and numbers, the total number of data which can be implemented in one digit is <NUM>, that is, <NUM> to <NUM>, a to z, and A to Z, and thus the information quantity of the input data may be <NUM><NUM>. In another example, when it is assumed that the input data (for example, AaB4@) is data of a five-digit number including letters, numbers, and special characters, the total number of data which can be implemented in one digit is <NUM>, that is, <NUM> to <NUM>, a to z, A to Z, and the number of special characters which can be input (assumed as <NUM>), and thus the information quantity of the input data may be <NUM><NUM>.

According to various embodiments, the example of calculating the information quantity of the data is only one embodiment, and the processor <NUM> may identify the information quantity of the data through various schemes. The processor <NUM> may identify the information quantity of the data through various schemes according to attributes of the input data (for example, attributes indicating whether the input data corresponds to a data type implemented by a combination of letters/numbers or a data type implemented by user's biometric information).

According to various embodiments of the disclosure, the processor <NUM> may identify types of elements (for example, letter, number, or special character) included in the input data and the number of elements included in the data, and identify the information quantity of the data on the basis of the types and the number of elements.

According to various embodiments of the disclosure, the processor <NUM> may select one of a plurality of keys stored in the memory <NUM> on the basis of the identified information quantity of the data.

According to various embodiments of the disclosure, the plurality of keys stored in the memory <NUM> may have different sizes, and the memory <NUM> may store data to which a range of the information quantity of the data and information indicating the key are mapped to use different keys depending on the information quantity of the data. The information indicating the key may be information (key size data) indicating the size of the key or information (index) indicating the key.

According to various embodiments of the disclosure, the memory <NUM> may store data to which the range of the information quantity of the data and the information indicating key are mapped to use a key having a larger size as the information quantity of the data increases. Alternatively, the memory <NUM> may store data to which the range of the information quantity of the data and the information indicating key are mapped to use a key having a smaller size as the information quantity of the data decreases. The data to which the range of the information quantity and the information indicating the key are mapped may be implemented in various forms. For example, the memory <NUM> may store data to which the range of the information quantity of the data and the information indicating the key are mapped in the form of a table as shown in [Table <NUM>] or [Table <NUM>] below.

Referring to [Table <NUM>], as the information quantity (X) of input data increases, the size of a key used for encryption of the input data may increase. Alternatively, as the information quantity (X) of input data decreases, the size of a key used for encryption of the input data may decrease. The size of the key may be the number of bits of the key. The memory <NUM> may store data to which a range of the information quantity and information indicating a key to be used for encryption of data included in the range of the information quantity are mapped in various forms (for example, the table shown in [Table <NUM>]). The data to which the range of the information quantity and the information indicating the key to be used for encryption of the data included in the range of the information quantity are mapped may be stored in another area which can be accessed in all of the normal area, the secure area, or the normal area and the secure area.

According to various embodiments of the disclosure, the processor <NUM> may identify the information quantity of the input data and identify the range of the information quantity to which the information quantity of the input data belongs. The processor <NUM> may select a key to be used for encryption of the input data among the plurality of keys on the basis of the range of the information quantity and the information indicating the key to be used for encryption of the data included in the range of the information quantity. According to various embodiments of the disclosure, the plurality of keys may be stored in the secure area and the normal area. According to various embodiments of the disclosure, when a password is configured, the processor <NUM> may identify the information quantity of the password and identify a range of the information quantity to which the information quantity of the input data belongs. The processor <NUM> may select a key to be used for encryption of the input data among the plurality of keys on the basis of the range of the information quantity and the information indicating the key to be used for encryption of the data included in the range of the information quantity. After receiving a user input, the processor <NUM> may encrypt data corresponding to the user input using a preselected key without identifying the information quantity of the data corresponding to the user input.

According to various embodiments of the disclosure, the processor <NUM> may encrypt the input data on the basis of the selected key. Encryption of the input data may be performed in the normal area on the basis of the control of the processor <NUM>.

According to various embodiments of the disclosure, the processor <NUM> may identify a certificate corresponding to each of the plurality of keys stored in the normal area. The certificate may be data for verifying reliability of the secure area or the key. The processor <NUM> may determine whether to encrypt the input data and whether to transmit the encrypted data to the secure area on the basis of the identification result of the certificate.

According to various embodiments of the disclosure, the processor <NUM> may transmit the encrypted data or information indicating the selected key (for example, information indicating the size of the selected key in [Table <NUM>] or the index indicating the selected key in [Table <NUM>]) to the secure area.

According to various embodiments of the disclosure, the data corresponding to the user input stored in the normal area may be automatically deleted after encryption is completed. The encrypted data may be stored in the secure area. Since the data corresponding to the user input is not stored in the normal area of the memory <NUM> and access to the secure area needs separate authority, security of the electronic device <NUM> can be improved.

According to various embodiments of the disclosure, even though data transmitted/received within the electronic device <NUM> is exposed to an attacker, encrypted data is exposed due to encryption of the data corresponding to the user input, and thus security of the data can be improved.

According to various embodiments of the disclosure, since the size of the key to be used for encryption may be selected on the basis of the information quantity of the input data, it is possible to prevent encryption speed from being declined, which may be generated due to encryption of data having a small information quantity using a key having the excessively large size.

According to various embodiments of the disclosure, the processor <NUM> may identify, in the secure area, information indicating encrypted data which is the result of encryption performed in the normal area and the key used for encryption. The processor <NUM> may select one of a plurality of keys stored in the secure area on the basis of information indicating the key used for encryption. The processor <NUM> may decrypt the encrypted data in the secure area using the selected key.

According to various embodiments of the disclosure, the processor <NUM> may perform an operation corresponding to the user input on the basis of the decrypted data. For example, when the user input is a user input of inputting a password for switching the locked state of the electronic device <NUM> to the unlocked state, the processor <NUM> may identify whether the input password is the same as a preset password on the basis of the decrypted data and switch the electronic device <NUM> from the locked state to the unlocked state on the basis of the identification result. For example, when the user input is a user input of inputting a password for activating various services (for example, financial services) which the electronic device <NUM> can provide, the processor <NUM> may identify whether the input password is the same as a preset password on the basis of the decrypted data and determine whether to activate the various services which the electronic device <NUM> can provide on the basis of the identification result.

According to various embodiments of the disclosure, the password may be data implemented by a combination of characters/numbers, data implemented by pattern information in various forms which can be input into a display, data implemented by user's biometric information (for example, various pieces of biometric information including a user's fingerprint, iris, or face), or data in various type which can be implemented in the future.

According to various embodiments of the disclosure, the processor <NUM> may encrypt the input data through an encryption scheme (for example, an RSA encryption algorithm or an ECIES algorithm) using a public key and a private key.

According to various embodiments of the disclosure, the memory <NUM> may include a public key and a private key and store a plurality of key sets having different sizes of data. The plurality of key sets may have different sizes, and a public key and a private key included in one key set may have the same size. The processor <NUM> may identify an information quantity of the input data and select one of the plurality of key sets corresponding to the information quantity of the data. The processor <NUM> may encrypt the input data in the normal area by using the public key included in the selected key set. The processor <NUM> may move the encrypted data and information indicating the selected key set from the normal area to the secure area. The processor <NUM> may identify the key set used for encryption of the encrypted data on the basis of the information indicating the selected key set in the secure area. The processor <NUM> may decrypt the encrypted data using the private key included in the identified key set. The private key may be stored in the secure area of the memory <NUM>, and the public key may be stored in the normal area of the memory <NUM>.

According to various embodiments of the disclosure, the normal area and the secure area includes the public key and the private key and may have a plurality key sets having different sizes of data. The plurality of key sets may have different sizes, and a public key and a private key included in one key set may have the same size. The processor <NUM> may identify an information quantity of the input data and select one of the plurality of key sets stored in the normal area on the basis of the information quantity of the data. The processor <NUM> may encrypt the input data in the normal area by using the public key in the secure area included in the selected key set and the private key in the normal area. The processor <NUM> may move the encrypted data and information indicating the selected key set from the normal area to the secure area. The processor <NUM> may identify the key set used for encryption of the encrypted data on the basis of the information indicating the selected key set in the secure area. The processor <NUM> may decrypt the encrypted data using the public key in the normal area included in the identified key set and the private key in the secure area.

The above-described embodiments assume that the encryption keys have been generated in advance, but the electronic device <NUM> may newly generate an encryption key according to a data input according to various embodiments of the disclosure. The processor <NUM> may generate a predetermined encryption key having the length which is the same as the length of the input data. The predetermined encryption key may be one-time data used for encrypting the input data. The processor <NUM> may encrypt the input data (for example, perform the exclusive OR operation (XOR operation) using the predetermined encryption key and the input data) on the basis of the predetermined encryption key and transmit the encrypted data to the secure area. The processor <NUM> may decrypt the encrypted data (for example, perform the XOR operation again on the encrypted data on which the XOR operation has been performed) transmitted to the secure area.

<FIG> is a block diagram <NUM> illustrating the normal area and the secure area in the electronic device according to various embodiments of the disclosure.

Referring to <FIG>, the electronic device <NUM> according to various embodiments of the disclosure may implement a normal area <NUM> and a secure area <NUM>. The normal area <NUM> and the secure area <NUM> may be areas divided according to the operation of the processor (for example, the processor <NUM> of <FIG>). The normal area <NUM> may be an area to which access is possible without any separate access authority. The secure area <NUM> may be an area which needs separate access authority for the secure area <NUM>.

According to various embodiments of the disclosure, the normal area <NUM> may encrypt data corresponding to a user input and transmit the encrypted data to the secure area <NUM>. The secure area <NUM> may receive the encrypted data and decrypt the encrypted data. The secure area <NUM> may perform an operation corresponding to the user input on the basis of the decrypted data.

According to various embodiments of the disclosure, the normal area <NUM> may include an input module <NUM>, an information quantity identification module <NUM>, a key selection module <NUM>, and an encryption module <NUM>.

According to various embodiments of the disclosure, the input module <NUM> may control a user interface (for example, the user interface <NUM> of <FIG>) to display a screen for receiving a user input. The input module <NUM> may receive the user input through the user interface <NUM> and transmit data corresponding to the user input to the information quantity identification module <NUM>.

According to various embodiments of the disclosure, the information quantity identification module <NUM> may receive the data transmitted by the input module <NUM> and identify the information quantity of the data. The information quantity of the data may be entropy of the data which is a value related to the number of cases of data having the same size as the input data.

According to various embodiments of the disclosure, the information quantity identification module <NUM> may identify types of elements (for example, letter, number, or special character) included in the input data and the number of elements included in the data, and identify the information quantity of the data on the basis of the types and the number of elements.

According to various embodiments of the disclosure, the key selection module <NUM> may select one of a plurality of keys on the basis of the information quantity of the data identified by the information quantity identification module. The selected key may be used for encryption of the data.

According to various embodiments of the disclosure, the plurality of keys may have different sizes and mapped with values related to the information quantity of the data. The key selection module <NUM> may identify the information quantity of the data and select a key corresponding to the information quantity of the data.

According to various embodiments of the disclosure, the encryption module <NUM> may encrypt the data received by the input module <NUM> using the key selected by the key selection module <NUM>. The encryption module <NUM> may transmit the encrypted data and information indicating the key used for encryption of the data to the secure area <NUM>. The information indicating the key used for encryption of the data may be information (key size data) indicating the size of the key and information (index) indicating the key.

According to various embodiments of the disclosure, the secure area <NUM> may include a decryption module <NUM> and a data processing module <NUM>.

According to various embodiments of the disclosure, the decryption module <NUM> may receive the data encrypted by the encryption module <NUM> and the information indicating the key used for encryption of the data. The decryption module <NUM> may identify a key used for encryption on the basis of the information indicating the key. The decryption module <NUM> may decrypt the encrypted data using the identified key. The decryption module <NUM> may transmit the decrypted data to the data processing module <NUM>.

According to various embodiments of the disclosure, the data processing module <NUM> may process the decrypted data transmitted by the decryption module <NUM>. Processing the decrypted data may be performing an operation corresponding to the user input. For example, when the user input is a user input of inputting a password for switching the electronic device <NUM> from the locked state to the unlocked state, the data processing module <NUM> may identify whether a correct password is input on the basis of the decrypted data and switch the electronic device <NUM> from the locked state to the unlocked state on the basis of the identification result. For example, when the user input is a user input of inputting a password for activating various services (for example, financial services) which the electronic device <NUM> can provide, the data processing module <NUM> may identify whether a correct password is input on the basis of the decrypted data and determine whether to activate the various services which the electronic device <NUM> can provide on the basis of the identification result.

An electronic device according to various embodiments of the disclosure may include a user interface, a processor operatively connected to the user interface, and a memory operatively connected to the processor and including a normal area and a secure area, wherein the memory may be configured to store a plurality of keys for encrypting data corresponding to a user input and store instructions causing the processor, when executed, receive the data through the user interface, nontemporarily store the received data in the normal area, identify an information quantity of the stored data, select at least one of the plurality of keys stored in the memory, based on at least a portion of the identified information quantity, encrypt the data using the selected key, and transmit the encrypted data and information indicating the selected key to the secure area which demands access authority.

In the electronic device according to various embodiments of the disclosure, the instructions may cause the processor to identify a key used for encryption of the encrypted data, based on the information indicating the selected key and decrypt the encrypted data stored in the secure area by using the identified key.

In the electronic device according to various embodiments of the disclosure, the instructions may cause the processor to identify a certificate corresponding to the identified key, authenticate the identified key, based on the identified certificate, and determine whether to perform an encryption operation of the input data, based on a result of the authentication.

In the electronic device according to various embodiments of the disclosure, the plurality of keys stored in the memory may be configured to have different sizes of data, and a public key of the plurality of keys is stored in the normal area of the memory and a private key of the plurality of keys is stored in the secure area of the memory.

In the electronic device according to various embodiments of the disclosure, the memory may be configured to further store information indicating a key to be used according to a range of the information quantity of the data, and the instructions cause the processor to select a key mapped to the range corresponding to the information quantity of the input data.

In the electronic device according to various embodiments of the disclosure, information indicating a key to be used may include information mapped such that a size of the key used for encryption of the input data increases according to the size of the input data.

In the electronic device according to various embodiments of the disclosure, the instructions may cause the processor to generate a predetermined key having a length equal to a length of the data, and encrypt the input data by using the generated key.

In the electronic device according to various embodiments of the disclosure, the generated key may be configured to have an information quantity equal to or larger than the information quality of the data.

In the electronic device according to various embodiments of the disclosure, the memory may include a public key and a private key and may be configured to store a plurality of key sets having different sizes of data, and the instructions cause the processor to select one of the plurality of key sets, based on the information quantity of the input data, encrypt the input data by using the public key included in the selected key set, and transmit the encrypted data or information indicating the selected key set to the secure area.

In the electronic device according to various embodiments of the disclosure, the instructions may cause the processor to decrypt the encrypted data by using the private key included in the selected key set on the basis of the information indicating the selected key set.

<FIG> is a flowchart <NUM> illustrating a method of operating an electronic device according to various embodiments of the disclosure.

Referring to <FIG>, in a method of operating an electronic device according to various embodiments of the disclosure, an electronic device (for example, the electronic device <NUM> of <FIG>) may receive data corresponding to a user input.

According to various embodiments of the disclosure, the electronic device <NUM> may receive the user input corresponding to the data to be encrypted through a user interface (for example, the user interface <NUM> of <FIG>).

According to various embodiments of the disclosure, the user input may be a user input of inputting a password for various functions which the electronic device <NUM> can provide. For example, the user input may be a user input of inputting a password for switching a locked state in which at least some functions are deactivated to an unlocked state in which at least some functions are activated. The password may be data implemented by a combination of characters/numbers, data implemented by pattern information in various forms which can be input into a display, data implemented by user's biometric information (for example, various pieces of biometric information including a user's fingerprint, iris, or face), or data in various type which can be implemented in the future.

According to various embodiments of the disclosure, the user interface <NUM> may be implemented in various forms for receiving a user input. For example, the user interface <NUM> may be implemented as a display. The display may display various screens on the basis of the control of the processor <NUM> and receive a user input on the display. The display may receive a user input corresponding to data to be encrypted. The display may display a screen for inputting a user input on the basis of the control of the processor <NUM>, receive the user input in the state in which the screen is displayed, and transmit data corresponding to the user input to the processor <NUM>. In another example, the user interface <NUM> may be a sensor module capable of acquiring user's biometric information. The user interface <NUM> may be implemented in the form of a fingerprint recognition sensor capable of acquiring user's fingerprint information in various types (for example, ultrasonic type or capacitive type), an infrared camera capable of acquiring user's iris information, and a Time of Flight (ToF) camera capable of acquiring user's face information.

According to various embodiments of the disclosure, in operation <NUM>, the electronic device <NUM> may identify an information quantity of data.

According to various embodiments of the disclosure, the information quantity of the data may be entropy of the data corresponding to a value related to the number of cases of data having the same size as the input data. The electronic device <NUM> may identify types of elements (for example, letter, number, of special character) included in the input data and the number of elements included in the data, and identify the information quantity of the data on the basis of the types and the number of elements.

According to various embodiments of the disclosure, in operation <NUM>, the electronic device <NUM> may select one of a plurality of keys on the basis of the information quantity of the data.

According to various embodiments of the disclosure, the plurality of keys may be stored in the memory <NUM>. The plurality of keys may have different sizes, and the memory <NUM> may store data to which a range of the information quantity of data and information indicating the key are mapped to use different keys according to the information quantity of the data. The information indicating the key may be information (key size data) indicating the size of the key or information (index) indicating the key.

According to various embodiments of the disclosure, the electronic device <NUM> may select a key corresponding to the information quantity of the data.

According to various embodiments of the disclosure, in operation <NUM>, the electronic device <NUM> may encrypt the data by using the selected key.

According to various embodiments of the disclosure, encryption of the input data may be performed in the normal area (for example, the normal area <NUM> of <FIG>) on the basis of the control of the processor <NUM>.

According to various embodiments of the disclosure, in operation <NUM>, the electronic device <NUM> may transmit the encrypted data and information indicating the selected key to the secure area (for example, the secure area <NUM> of <FIG>).

According to various embodiments of the disclosure, the data corresponding to the user input stored in the normal area may be automatically deleted after encryption is completed. The encrypted data may be stored in the secure area. The data corresponding to the user input may not be stored in the normal area of the memory <NUM>, and access to the secure area demands separate authority, and thus security of the electronic device <NUM> can be improved.

According to various embodiments of the disclosure, due to encryption of the data corresponding to the user input, the encrypted data is exposed even though data transmitted/received within the electronic device <NUM> is exposed to an attacker, and thus security of the data can be improved.

<FIG> is a flowchart <NUM> illustrating the operation in a method of operating an electronic device according to various embodiments.

Referring to <FIG>, in a method of operating an electronic device according to various embodiments of the disclosure, an electronic device (for example, the electronic device <NUM> of <FIG>) may receive encrypted data and information indicating a selected key transmitted in a normal area (for example, the normal area <NUM> of <FIG>) in operation <NUM>.

According to various embodiments of the disclosure, the electronic device <NUM> may identify a key used for encryption on the basis of the information indicating the selected key in operation <NUM>.

According to various embodiments of the disclosure, the information indicating the selected key may be information indicating the size of the key (key size data) or information (index) indicating the key.

According to various embodiments of the disclosure, the electronic device <NUM> may decrypt the encrypted data using the identified key in operation <NUM>.

According to various embodiments of the disclosure, the electronic device <NUM> may perform an operation corresponding to a user input on the basis of the decrypted data. For example, when the user input is a user input of inputting a password for switching the electronic device <NUM> from the locked state to the unlocked state, the electronic device <NUM> may identify whether a correct password is input on the basis of the decrypted data and switch the electronic device <NUM> to the locked state to the unlocked state on the basis of the identification result. For example, when the user input is a user input of inputting a password for activating various services (for example, financial services) which the electronic device <NUM> can provide, the electronic device <NUM> may identify whether a correct password is input on the basis of the decrypted data and determine whether to activate the various services which the electronic device <NUM> can provide on the basis of the identification result.

A method of operating an electronic device according to various embodiments of the disclosure may include an operation of receiving data corresponding to a user input through a user interface, an operation of nontemporarily storing the received data in a normal area of a memory, an operation of identifying an information quantity of the stored data, an operation of selecting one of a plurality of keys stored in the memory on the basis of at least a portion of the information quantity of the data, an operation of encrypting the data by using the selected key, and an operation of transmitting the encrypted data and information indicating the selected key to a secure area which demands access authority.

The method of operating the electronic device according to various embodiments of the disclosure may further include an operation of identifying a key used for encryption of the encrypted data, based on the information indicating the selected key and an operation of decrypting the encrypted data stored in the secure area by using the identified key.

The method of operating the electronic device according to various embodiments of the disclosure may further include an operation of identifying a certificate corresponding to the identified key, an operation of authenticating the identified key, based on the identified certificate, and an operation of determining whether to decrypt the encrypted data, based on a result of the authentication.

In the method of operating the electronic device according to various embodiments of the disclosure, the plurality of keys stored in the memory may be configured to have different sizes of data, and a public key of the plurality of keys may be stored in the normal area of the memory and a private key of the plurality of keys may be stored in the secure area of the memory.

The method of operating the electronic device according to various embodiments of the disclosure may further include an operation of identifying information indicating a key to be used for encryption according to a range of the information quantity of the data and an operation of selecting a key mapped to the range corresponding to the information quantity of the input data.

In the method of operating the electronic device according to various embodiments of the disclosure, information indicating a key to be used may include information mapped such that a size of the key used for encryption of the input data increases according to the size of the input data.

The method of operating the electronic device according to various embodiments of the disclosure may further include an operation of generating a predetermined key having a length equal to a length of the data and an operation of encrypting the input data by using the generated key.

In the method of operating the electronic device according to various embodiments of the disclosure, the generated key may be configured to have an information quantity equal to or larger than the information quality of the data.

The method of operating the electronic device according to various embodiments of the disclosure may further include an operation of selecting one of the plurality of key sets including a public key and a private key on the basis of the information quantity of the input data, an operation of encrypting the input data by using the public key included in the selected key set, and an operation of transmitting the encrypted data or information indicating the selected key set to the secure area.

The method of operating the electronic device according to various embodiments of the disclosure may further include an operation of decrypting the encrypted data by using the private key included in the selected key set on the basis of the information indicating the selected key set.

Claim 1:
An electronic device (<NUM>) comprising:
a user interface (<NUM>);
a processor (<NUM>) operatively connected to the user interface; and
a memory (<NUM>) operatively connected to the processor and comprising a normal area and a secure area,
wherein the memory is configured to store a plurality of keys for encrypting user input data corresponding to a user input and store instructions causing the processor, when executed, receive the data through the user interface, nontemporarily store the received data in the normal area, identify an information quantity of the stored data, select at least one of the plurality of keys stored in the memory, based on at least a portion of the identified information quantity, encrypt the stored data using the selected key, and transmit the encrypted data and information indicating the selected key to the secure area which demands access authority,
wherein the memory is configured to further store information indicating a key to be used according to a range of the information quantity of the user input data, and
wherein the instructions cause the processor to select the key mapped to the range corresponding to the information quantity of the user input data such that the electronic device encrypts the stored data by using the key having smaller size as the information quantity of the input data decreases.