Boot Record Verification for Virtual Device Key Access

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

In virtual device platforms, keys used for cryptographic operations are not adequately protected from misuse by bad actors, as they can access and boot unauthorized versions of the operating system, compromising security.

Innovation Solution

The system generates and compares independent first and second boot records to verify the authenticity of a virtual device, obtaining an identity certificate only upon a match, which is then used to authorize the virtual device to access cryptographic keys.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Ease of operation

If keys are stored in data partitions accessible to virtual devices, then cryptographic operations can be performed, but security is compromised allowing bad actors to access and misuse keys

Engineering Contradiction:

Improveaccess to cryptographic keysVSAvoidsecurity protection of keys

Core Design Contradiction:

Ease of operationVSReliability

Solution Approach 1:

The patent introduces boot records as an intermediary authentication mechanism between the virtual device and the cryptographic keys. The boot records verify the authenticity of the boot process before allowing key access, acting as a mediator that enables secure access without direct exposure of keys to potentially malicious virtual devices.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The system performs preliminary verification of boot process authenticity by checking boot records before granting access to cryptographic keys. This preliminary action ensures that only legitimate boot processes can access keys, preventing bad actors from misusing keys even if they gain access to the virtual device environment.

Inventive Principle:

Principle #10Preliminary action

2Reliability

If boot process verification is implemented using boot records, then key access security is improved, but system complexity increases

Engineering Contradiction:

Improveauthentication of virtual deviceVSAvoidboot verification mechanism

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The patent creates boot records that are independent copies or representations of the boot process state. These boot records can be generated, stored, and verified without modifying the actual boot process, simplifying the verification mechanism while maintaining security. The boot records serve as verifiable copies that prove the authenticity of the boot process.

Inventive Principle:

Principle #26Copying

3Reliability

If independent boot records are generated and compared, then unauthorized access is prevented, but processing time increases

Engineering Contradiction:

Improveprevention of unauthorized key accessVSAvoidboot verification duration

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

The boot records are designed as lightweight, easily generated data structures that can be quickly created and verified. Their simple format allows for rapid comparison operations, minimizing the time penalty associated with security verification. The boot records serve their purpose as disposable authentication tokens that are quickly validated and then discarded.

Inventive Principle:

Principle #27Cheap short-living objects (Disposable)

Data Source

PatentUS11868476B2Boot-specific key access in a virtual device platform

Publication Date: 2024.01.09 HYPORI INC

AI summary

Some embodiments may facilitate boot-specific key access to perform cryptographic operations. A first boot record and a second boot record may be generated independently in response to a request to boot a virtual device. The first and second boot records may be compared and in response to a match between the first boot record and the second boot record, an identify certificate may be obtained. Authorization to access and use a key for cryptographic operations may be obtained in response to a verification of the identity certificate by a cryptographic processor.