Active Register Bank Key Vaults for Side-Channel-Resistant Storage
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing computing devices face security vulnerabilities in storing cryptographic keys due to potential attacks on secure locations, including side channel attacks, and existing multi-party computation systems struggle with decentralized key generation in production environments.
Innovation Solution
Implementing a key vault with an active register bank that uses modular arithmetic to distribute and mask cryptographic keys, combined with auto-refresh capabilities and restricted access permissions to enhance security, ensuring that only authorized entities can perform specific operations on the keys.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If cryptographic keys are stored in secure locations such as root of trust modules, then key security is improved, but the system becomes vulnerable to side channel attacks and hardware faults
Solution Approach 1:
The patent divides the master private key into multiple shares and distributes them across different memory locations (active register bank and non-volatile memory). This segmentation ensures that no single location contains the complete key, making the system resistant to side channel attacks and hardware faults that target specific storage locations.
Solution Approach 2:
The patent implements dynamic key management where key shares are actively refreshed and rotated between different memory locations. The active register bank contains moving key shares that change over time, preventing static vulnerability patterns and making side channel attacks ineffective against fixed memory locations.
2Reliability
If multi-party computation systems are used for decentralized key generation, then key distribution security is improved, but the system becomes complex and difficult to implement in production environments
Solution Approach 1:
The patent segments the key generation and management process into distinct functional components: a setup processor for initial key generation, an active register bank for dynamic key storage, and non-volatile memory for persistent storage. This segmentation simplifies the overall system architecture while maintaining the security benefits of decentralized key management.
Solution Approach 2:
The patent introduces an intermediary active register bank that mediates between the setup processor and non-volatile memory. This intermediary layer handles the complex operations of key sharing, masking, and refreshing, abstracting the complexity from the overall system while enabling secure key distribution.
3Duration of action of stationary object
If key shares are stored in non-volatile memory, then key persistence is improved, but the keys become accessible to unauthorized entities and unable to be refreshed
Solution Approach 1:
The patent segments key storage between non-volatile memory (for persistence) and the active register bank (for controlled access and refreshing). Only authorized processors can access specific portions of non-volatile memory, while the active register bank provides a protected environment for key shares that can be dynamically updated and refreshed.
Solution Approach 2:
The patent makes key storage dynamic by continuously refreshing key shares in the active register bank and rotating them between memory locations. This dynamic approach allows non-volatile memory to provide persistence while the active register bank maintains controlled accessibility and enables ongoing key updates without compromising security.
Data Source
AI summary
Systems and techniques are provided for secure computing. For instances, a process can include generating a master private key; generating a set of first dummy values; dividing the master private key into a first set of shares, wherein a sum of shares of the first set of shares equals a value of the master private key; initiating portions of an active memory bank with a sequence of integer modular additions, wherein the integer modular additions comprise: masking the first set of shares of the master private key; and adding the masked first set of shares of the master private key to portions of the active memory bank using a sequence of adds that adds and mixes the masked first set of shares of the master private key with dummy values.