Industrial Credential Wallets With Device-Bound Cryptographic Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Industrial devices face security vulnerabilities due to the use of counterfeit or unauthorized devices, despite the implementation of conventional wallets, leading to insecure operations in IT security and safety.
Innovation Solution
An industrial device with a wallet containing credentials is cryptographically bound to a specific device, using device-specific keys and secure elements to prevent access and use on unauthorized or counterfeit devices, ensuring enhanced security through cryptographic binding and secure storage of master and wallet secrets.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If a conventional wallet is used to store credentials on industrial devices, then the wallet can be copied and transferred to different devices, but security is compromised because counterfeit or unauthorized devices can access the credentials
Solution Approach 1:
The system segments the credential access mechanism into two parts: the wallet containing credentials and the device-specific binding mechanism. The wallet itself remains transferable, but its usability is segmented by device authentication, allowing the same wallet to be securely used across multiple authorized devices while blocking unauthorized access.
Solution Approach 2:
A device binding mechanism acts as an intermediary between the wallet and the device hardware. This intermediary verifies device authenticity before allowing wallet access, preventing direct unauthorized access while maintaining the wallet's portability across legitimate devices.
2Ease of operation
If the wallet master key is accessible to the user for wallet access, then the user can easily access the wallet, but the master key can be copied or compromised on unauthorized devices
Solution Approach 1:
The dangerous element (raw master key) is extracted from the user's direct control and replaced with a device-bound authentication mechanism. The user retains ease of access through biometric or password authentication, but the actual cryptographic operations are performed by the device-bound wallet controller, preventing key exposure.
Solution Approach 2:
The authentication model transitions from a single-dimension password system to a multi-dimensional system combining user credentials with device-specific binding. This adds a device identity dimension that prevents key compromise on unauthorized devices while maintaining user accessibility on authorized devices.
3Reliability
If device-specific binding is implemented to prevent unauthorized access, then security is enhanced, but the wallet cannot be used on different authorized devices
Solution Approach 1:
The wallet system is designed with multi-functionality: it can be bound to multiple authorized devices simultaneously, serving both security (preventing unauthorized access) and versatility (allowing authorized device switching). The device binding mechanism supports universal authorization across device types while maintaining security constraints.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
The industrial device contains a wallet containing credentials for accessing industrial apps and equipped with a master key securing the wallet. The wallet is cryptographically bound to the specific industrial device. References: [1] https://github.com/hyperledger/aries-rfcs/blob/main/concepts/0050-wallets/README.md