Cryptographic Key Protection Conversion Between Security Levels
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cryptographic security solutions either prioritize high security at the cost of performance or high performance at the expense of security, as tamper-resistant devices provide strong security but may impact performance, while crypto assist devices offer high performance but lack key protection.
Innovation Solution
A computer program product manages cryptographic keys by encrypting them under a master key for high security and then converting the protection to a second level of security that includes CPU internal registers and secure hardware, allowing for secure key usage without performance degradation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a tamper-resistant cryptographic device is used to protect cryptographic keys, then security is improved, but performance is worsened due to heat dispersion concerns limiting operating frequency
Solution Approach 1:
The system divides cryptographic operations into two segments: key management operations (generate, store, protect) are performed in the tamper-resistant device, while bulk cryptographic operations (encrypt, decrypt, sign) are performed in the crypto assist device. This segmentation allows each component to operate in its optimal performance range while maintaining overall security.
Solution Approach 2:
The patent introduces a key wrapping mechanism as an intermediary. The tamper-resistant device wraps cryptographic keys with a wrapping key before transferring them to the crypto assist device. This intermediary layer allows the unprotected device to handle bulk operations while the protected device maintains key security, resolving the contradiction between protection and performance.
2Productivity
If a crypto assist device is used for high-performance cryptographic operations, then performance is improved, but security is worsened because cryptographic keys appear in the clear outside a trusted boundary
Solution Approach 1:
The system performs preliminary key wrapping in the tamper-resistant device before keys are used in the crypto assist device. The wrapping key and wrapped key are established in advance in a secure manner, allowing subsequent bulk operations to proceed rapidly without compromising key security. This preliminary secure setup enables high-performance operations without exposing keys in clear text.
3Reliability
If cryptographic keys are protected in a tamper-resistant device, then security is improved, but device complexity increases due to physical security enclosures and tamper resistance mechanisms
Solution Approach 1:
The patent extracts the bulk cryptographic operations from the tamper-resistant device and places them in a separate crypto assist device. Only essential key management functions remain in the complex secured device, while routine operations are handled by simpler unsecured devices. This extraction reduces the operational burden on the complex secure device while maintaining security requirements.
Data Source
AI summary
Protection of cryptographic keys is converted between one level of security and another level of security. The one level of security is different from the another level of security, and the another level of security includes the components of the one level of security.