Cryptographic Key Binding for Verified HSM Configurations
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The security of cryptographic keys, particularly master keys, is compromised when used in improperly configured Hardware Security Modules (HSMs), relying on untrusted computing devices for configuration settings, leading to vulnerabilities that affect all encrypted keys.
Innovation Solution
A method and device that bind a cryptographic key, such as a master key, with a policy specifying a permitted configuration, ensuring the key is only used in a properly configured HSM by comparing the HSM's configuration with the policy before allowing storage or use, using criteria like 'exact match' or 'at least as strict'.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If a master key is loaded into an HSM without configuration verification, then the key can be used immediately, but the security of all encrypted keys is compromised
Solution Approach 1:
The system performs preliminary verification of HSM configuration consistency with the master key policy before allowing key loading or use. This advance check ensures that the HSM is properly configured according to the associated policy, preventing security compromises while maintaining efficient key operations.
2Reliability
If configuration verification is performed before key use, then key security is maintained, but the time required for key operations increases
Solution Approach 1:
The configuration consistency check is performed once during key loading or initialisation, rather than repeatedly during each key operation. This preliminary verification ensures security while minimizing time overhead during subsequent key usage operations.
3Reliability
If the HSM configuration is strictly enforced, then unauthorized key use is prevented, but the flexibility to use keys in different configurations is reduced
Solution Approach 1:
The master key policy acts as an intermediary that defines the permissible configuration parameters between the key and the HSM. This policy framework enables strict security enforcement while maintaining flexibility, as the policy can be configured to allow different HSM settings depending on the specific security requirements and operational needs.
Data Source
AI summary
A computer-implemented method for controlling use of a first cryptographic key in a device, wherein the device stores first information specifying the configuration of the device. The method comprising: obtaining the first cryptographic key and second information specifying a device configuration for which use of the first cryptographic key is permitted; comparing the second information with the first information to determine whether the first information is consistent with the second information; and in response to determining that the first information is consistent with the second information, performing a first operation using the first cryptographic key on the device.