Cryptographic Key Platform Architecture for Multi-Module Compatibility
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cryptographic service platforms face challenges in providing stable cryptographic services due to reliance on a single security module manufacturer, leading to potential security risks and compatibility issues with various security modules.
Innovation Solution
A cryptographic service platform that includes a primary security module generating master keys for secondary modules, storing working key ciphertexts, and enabling cryptographic operations across multiple security modules, ensuring key security and compatibility.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If a cryptographic service platform relies on a single security module manufacturer, then the platform can be simpler to manage, but the security risk increases and compatibility with various security modules is reduced
Solution Approach 1:
The system segments the security module ecosystem into a primary security module that generates master keys and multiple secondary security modules that use these keys. This segmentation allows the platform to work with multiple manufacturers (reducing risk and improving compatibility) while the primary module centralizes key management (maintaining simplicity).
Solution Approach 2:
The primary security module acts as an intermediary between the platform and multiple secondary security modules from different manufacturers. It generates and distributes working keys to secondary modules, enabling compatibility across different vendors while maintaining centralized control and simplified platform management.
2Adaptability or versatility
If a cryptographic service platform supports multiple security module manufacturers, then compatibility improves, but the system complexity increases
Solution Approach 1:
The primary security module provides universal functionality by generating working keys that can be used across multiple secondary security modules from different manufacturers. This multi-functional approach enables the system to support various vendors without requiring separate key management systems for each, thus improving compatibility while avoiding proportional increases in complexity.
3Ease of operation
If master keys are stored outside the security module boundary, then key management becomes more flexible, but security risks increase
Solution Approach 1:
The working key is nested within the primary security module's protective boundary during generation and distribution. The primary module generates the working key, encrypts it, and distributes it to secondary modules while maintaining the key's security within the trusted boundary. This nesting approach provides both security (key protection within boundary) and flexibility (controlled distribution to multiple modules).
Data Source
Figure 1~2A
Figure 2B~2C
Figure 2D~3
AI summary
The present specification provides a cryptographic operation method, a working key creation method, a cryptographic service platform, and a cryptographic service device. In a security module connected to the cryptographic service platform, a key management function is provided by a primary security module. The primary security module is used for generating a key. Both the primary security module and secondary security modules can provide a cryptographic operation function required by the cryptographic service platform. A master key of each secondary security module is generated by the primary security module. A working key of a business system is also generated by the primary security module. In addition, the cryptographic service platform stores a working key ciphertext encrypted by the master key of the primary security module and a working key ciphertext encrypted by the master key of each secondary security module. Neither the master key nor a working key plaintext, which functions as sensitive security parameters, exceeds a boundary of the security module, such that the security of the key is not put at risk, thereby meeting key security requirements. The cryptographic service platform can also be compatible with various security modules so as to provide a more stable cryptographic service.