Device-Specific CPU Key Embedding for Unauthorized Code Prevention
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current closed platforms that digitally distribute software face significant security vulnerabilities as the same digital signature is used across all devices, allowing unauthorized code execution if the operating system is breached, rendering existing security features ineffective against software piracy.
Innovation Solution
A unique key pair is generated for each device, with the public key embedded in the CPU and the private key stored securely, ensuring that only digitally signed code with the private key can be executed, preventing unauthorized code execution by verifying the signature at the CPU level for each instruction.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If the same digital signature is used across all devices, then software distribution is simplified and easier to implement, but security is compromised as unauthorized code can be executed if the operating system is breached
Solution Approach 1:
The patent segments the digital signature system by creating device-specific key pairs. Each device receives a unique public key embedded in its CPU and a corresponding private key stored securely. This segmentation ensures that software signed for one device cannot be executed on another device, preventing unauthorized code execution while maintaining simplified distribution processes.
Solution Approach 2:
The patent applies local quality by making each device's security credentials unique to that specific device. The public key is embedded in the CPU of each individual device, and software is signed with the corresponding private key specific to that device. This ensures that security properties are localized to each device rather than being uniform across all devices.
2Device complexity
If a single digital signature is used for all devices, then the system complexity is reduced, but the security feature can be defeated and unauthorized code can be executed
Solution Approach 1:
The patent divides the signature system into device-specific segments. Each device has its own public key embedded in the CPU and its own private key stored securely. Software is signed individually for each device, creating a segmented security architecture that prevents system-wide compromise while maintaining manageable complexity through automated key distribution.
Solution Approach 2:
The patent performs preliminary action by embedding the public key in the CPU during device manufacturing and pre-establishing the correspondence between public and private keys. This preliminary setup eliminates the need for complex runtime key management and simplifies the overall system while ensuring security.
3Adaptability or versatility
If the operating system is breached and signature checks are disabled, then unauthorized code execution becomes possible, but this vulnerability exists across all devices using the same signature
Solution Approach 1:
The patent segments the code execution authority by embedding unique public keys in each device's CPU. Software must be signed with the specific private key corresponding to the device's public key. This segmentation ensures that even if one device's operating system is breached, the compromise cannot be transferred to other devices, as each device has its own independent security credentials.
Solution Approach 2:
The patent applies local quality by making security verification device-specific. Each device verifies software signatures using its own embedded public key, ensuring that security properties are localized. This prevents a breach on one device from affecting other devices and stops the propagation of unauthorized code execution across the system.
Data Source
AI summary
Systems and method provide for generation of a unique key pair having a public and private key for an individual device. The public key may be embedded (e.g., burned or etched) into a central processing unit (CPU) during the manufacturing process. The burning or etching process may make the public key unmodifiable. The matching private key may then be stored in a secure database. Software code may be available through download over a computer based network (e.g., the Internet). A request may be made for the software code. Prior to delivery, the software code may be digitally signed with the private key corresponding to the individual device. Logic programmed into the CPU may prevent the execution of code that is not signed with the private key that corresponds to the public key.