Cryptographically Protected Packages for Runtime Software Verification

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing methods for digital signing and encryption of system software on IoT devices face challenges in scalability, distribution of cryptographic artifacts, management of secrets, and protection of intellectual property, especially in large-scale systems with multiple software modules and across different target platforms.

Innovation Solution

A system that aggregates solution components into a device package with digital signing and encryption, using a device package map for verification and decryption at runtime, and manages cryptographic artifacts with embedded object stores and device package maps.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If digital signing and encryption are applied to each file individually in large-scale IoT systems, then data confidentiality and integrity are improved, but device complexity and management overhead increase significantly

Engineering Contradiction:

Improvedata confidentialityVSAvoidmanagement overhead

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The patent combines multiple cryptographic operations (signing, encryption, key management) into a unified device package structure. All solution components are aggregated into a single package with centralized cryptographic artifact management, eliminating the need to manage individual cryptographic operations for each file separately.

Inventive Principle:

Principle #5Merging (Combining)

Solution Approach 2:

The device package serves multiple functions simultaneously: it acts as a container for solution components, a repository for cryptographic artifacts, a verification mechanism through package maps, and a distribution unit. This multi-functional approach reduces overall system complexity while maintaining security.

Inventive Principle:

Principle #6Universality (Multi-functionality)

2Reliability

If cryptographic artifacts are distributed to multiple target platforms with target-specific artifacts, then privacy protection is improved, but distribution complexity and artifact management difficulty increase

Engineering Contradiction:

Improveprivacy protectionVSAvoidartifact distribution

Core Design Contradiction:

ReliabilityVSEase of operation

Solution Approach 1:

The patent segments cryptographic artifacts into device-specific portions and universal portions. Each device package contains only the cryptographic artifacts relevant to that specific device or device class, while shared artifacts are managed centrally. This segmentation enables targeted distribution to reduce complexity.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The device package acts as an intermediary that bundles appropriate cryptographic artifacts for each target platform. Instead of directly distributing individual artifacts to multiple platforms, the system creates customized packages that mediate the distribution process, simplifying artifact management.

Inventive Principle:

Principle #24Intermediary (Mediator)

3Adaptability or versatility

If system software is exported to foreign countries for operation, then global deployment capability is improved, but intellectual property protection and secret security deteriorate

Engineering Contradiction:

Improveglobal deploymentVSAvoidintellectual property protection

Core Design Contradiction:

Adaptability or versatilityVSReliability

Solution Approach 1:

The patent implements nested cryptographic protection where device packages contain encrypted solution components, which are further protected by cryptographic artifacts stored within the same package structure. This nested arrangement maintains security layers even when software is deployed globally.

Inventive Principle:

Principle #7Nested doll (Nesting)

Solution Approach 2:

The system performs preliminary cryptographic protection by signing and encrypting solution components before they are exported or deployed to foreign devices. The device package is prepared in advance with all necessary cryptographic artifacts embedded, ensuring IP protection is established before international distribution occurs.

Inventive Principle:

Principle #10Preliminary action

Data Source

PatentEP3888292B1System and method for protection of multipart system applications using a cryptographically protected package, a package map and a package object store for decryption and verification at runtime on the target device platform

Publication Date: 2025.09.24 MOCANA CORP

Figure 1
Figure 2
Figure 3

AI summary

For protection of multipart system applications using a cryptographically protected package, a package map and a package object store for decryption and verification at runtime on the target device platform, a method including associating a device class with a set of content signing and encryption keys; signing application files based on the device class of the target device platform; aggregating application files into a file container based on a structured construct; encrypting application files/file containers with an encryption key associated with the device class; generating a package map and object stores for cryptographic artifacts and detached package metadata for passwords associated with the device package; building, the device package and update packages of the device package, detached package metadata, and package install scripts for the target device platform; publishing, the update packages signed with update package provider and update package publisher signing keys, and encrypted with target device encryption key.