Configurable Cryptographic Key Permissions for Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In cryptographic processing systems, existing technologies lack effective methods to securely manage and protect cryptographic keys, particularly in scenarios where not all system components can be trusted, leading to potential unauthorized access and misuse of keys.
Innovation Solution
Assigning configurable properties to cryptographic keys that define permitted operations, ensuring that only authorized components can perform specific operations, and implementing key wrapping and unwrapping to maintain security during transmission and storage, thereby limiting key usage to predefined states and operations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If cryptographic keys are stored in accessible locations for system operation, then system functionality is improved, but security against unauthorized access deteriorates
Solution Approach 1:
The system segments key usage permissions into multiple independent permission bits (e.g., permission to use for encryption, decryption, key generation, etc.). Each permission can be independently controlled and granted to different components, allowing fine-grained access control without requiring complete key exposure.
Solution Approach 2:
Different components of the system are granted different permission levels based on their specific functional requirements. For example, a component needing only encryption can be granted only encryption permissions, while another component may need additional permissions. This local differentiation of access rights maintains security while enabling necessary functionality.
2Adaptability or versatility
If more components are given access to cryptographic keys for versatility, then system adaptability is improved, but security reliability deteriorates
Solution Approach 1:
The permission structure is designed to be dynamic and configurable. Permissions can be assigned, modified, or revoked based on operational requirements without changing the underlying key storage or component architecture. This allows the system to adapt to different security requirements while maintaining reliable protection through the permission layer.
3Reliability
If cryptographic keys are protected with high-security measures, then security is improved, but device complexity increases
Solution Approach 1:
The permission system acts as an intermediary layer between the cryptographic keys and system components. Instead of implementing complex physical or cryptographic protection mechanisms throughout the system, the permission layer provides a manageable interface that controls key usage, simplifying the overall system architecture while maintaining security.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
In accordance with a first aspect of the present disclosure, a method is conceived for setting permissions for cryptographic keys in a cryptographic processing system, comprising: generating at least one cryptographic key to be protected; assigning one or more configurable properties to said cryptographic key; wherein the configurable properties define at least one of a permission of performing a first set of predefined operations on the cryptographic key and a permission of using the cryptographic key for performing a second set of predefined operations. In accordance with a second aspect of the present disclosure, a corresponding computer program is provided. In accordance with a third aspect of the present disclosure, a corresponding cryptographic processing system is provided.