Device-Bound PKI Private Key Binding
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing public key infrastructure (PKI) encryption systems are vulnerable to private key copying, stealing, and the use of fake private keys, as the secret part of the PKI subsystem is not adequately secured.
Innovation Solution
A device-bound PKI system is implemented, where a private key is generated and bound to a specific device using a unique device identifier, with a filler code calculated from the identifier and the private key, allowing only the device to decrypt encrypted data by adding the filler code to the identifier.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional PKI encryption is used, then data exchange can be performed, but the private key can be copied, stolen or faked
Solution Approach 1:
The system performs preliminary actions by generating a unique device identifier from the device's computing environment characteristics before any data exchange occurs. This identifier is then used to bind the private key to the specific device, preventing key copying and theft before they can happen during data exchange operations.
Solution Approach 2:
The patent introduces a filler code as an intermediary element that bridges the device identifier and the private key. The filler code is calculated based on both the device identifier and the private key, creating a binding mechanism that ties the private key to the specific device without directly exposing the key itself.
2Reliability
If a device-bound private key system is implemented, then security is enhanced, but the system complexity increases
Solution Approach 1:
The system employs self-service mechanisms where the device's own computing environment characteristics are used to generate its unique device identifier. The device essentially identifies itself through its inherent hardware and software configuration, eliminating the need for external authentication infrastructure and reducing overall system complexity.
Solution Approach 2:
The patent changes parameters by transforming static key pairs into dynamic device-bound keys. The private key is no longer a standalone secret but becomes parameter-dependent, varying based on the device identifier and filler code, thereby enhancing security while maintaining manageable complexity through mathematical relationships.
3Reliability
If filler code calculation is performed, then key binding is achieved, but computational overhead increases
Solution Approach 1:
The filler code is calculated in advance during the key generation phase rather than during each data exchange operation. This preliminary calculation stores the binding relationship without requiring repeated computational overhead during actual encryption and decryption operations, reducing energy consumption during active use.
Solution Approach 2:
The system uses mathematical copying relationships where the filler code can be derived from the device identifier and private key through deterministic calculations. This allows the binding information to be replicated and verified without requiring the original computational process, reducing energy overhead during verification operations.
Data Source
AI summary
Techniques are provided secured communication of data, such as in the context of a public key infrastructure (PKI). In one embodiment, the technique may involve using a private key that is bound to the device requesting the secure data, thereby making it harder for someone to copy, steal or fake. The private key may be generated by adding a filler code to a unique device identifier. The identifier may be based on at least one user-configurable parameter and at least one non-user-configurable parameter of the device.