Digital Certificate Version Control via Firmware Fuses
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems face challenges in securely updating cryptographic keys in computing devices, as compromised keys can still be trusted if loaded with the original trusted key certificate, leading to potential security risks.
Innovation Solution
Incorporating version numbers for digital certificates and cryptographic keys, where the system only trusts certificates and keys with version numbers matching or exceeding those stored in firmware fuses, and allowing updates only with authorization from a trusted entity, thereby preventing the use of lower version numbers.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If digital certificates and cryptographic keys are updated, then security is improved, but the risk of compromised keys being trusted increases if version control is not implemented
Solution Approach 1:
The patent applies parameter changes by introducing version numbers as a new parameter for digital certificates and cryptographic keys. The system stores version indicators in firmware fuses and compares them against version numbers in certificates and keys. This parameter change enables the system to distinguish between valid and compromised cryptographic materials, resolving the contradiction by providing a mechanism to ensure that only current, trusted versions are accepted while rejecting outdated or compromised versions.
2Reliability
If version number checking is implemented, then security against compromised keys is improved, but system complexity increases
Solution Approach 1:
The patent implements self-service by having the version checking mechanism automatically integrated into the certificate and key validation process. The system automatically retrieves version indicators from firmware fuses, compares them against certificate and key version numbers, and makes trust decisions without requiring external intervention or complex manual verification procedures. This automation reduces system complexity while maintaining security improvements.
3Reliability
If cryptographic keys are updated frequently, then security is improved, but operational overhead increases
Solution Approach 1:
The patent applies preliminary action by pre-storing version indicators in firmware fuses before cryptographic operations are performed. This allows the system to quickly validate certificates and keys by comparing against pre-established version benchmarks, eliminating the need for time-consuming verification processes during key updates. The preliminary storage of version information reduces operational overhead while enabling frequent, secure key updates.
Data Source
AI summary
A computing device includes a processor and a persistent memory for storing information about a first public key associated with a first asymmetric key pair for authenticating the source of a digital certificate. The computing device also includes a second memory for storing one or more current certificate version indicators, each associated with a corresponding digital certificate, and the version indicator is used by the processor to determine the trust of the corresponding digital certificate.