Distributed Cryptographic Key Insertion and Delivery
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
IoT device manufacturers face challenges in securely generating, inserting, and managing device-individual cryptographic keys during manufacturing, as they lack direct trust relationships with end customers and have limited resources for secure key management, leading to complexity and overhead in ensuring key security and confidentiality.
Innovation Solution
The method involves loading integrated circuits (ICs) with unique identification numbers and key derivation data, using manufacturer configuration parameters and secret values to calculate device-specific keys, which are then applied with product-specific parameters through a secure application on a smart card, ensuring secure key derivation and delivery directly to customers without revealing keys to manufacturers or intermediaries.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If device-individual cryptographic keys are provided during manufacturing, then security of key exchange is improved, but manufacturing complexity and overhead increase
Solution Approach 1:
The key management process is segmented into two independent parts: (1) IC manufacturer loads ICs with only UID and KDD during standard manufacturing, and (2) IoT device manufacturer later loads MDP into ICs and generates DSKs. This segmentation removes complex key management from the IC manufacturing process while maintaining security, as each party only handles simple, well-defined operations.
Solution Approach 2:
The IC manufacturer performs preliminary actions by loading ICs with UID and KDD during standard manufacturing before the ICs are even delivered to customers. This preliminary setup eliminates the need for special secure key insertion procedures later, as the foundation for secure key generation is already in place and can be completed by anyone with basic programming capability.
2Reliability
If trusted third parties are used for key delivery, then key security is improved, but loss of time and increased overhead occur
Solution Approach 1:
The IoT device manufacturer performs self-service by loading MDP into ICs and generating DSKs using the pre-loaded KDD and UID. This eliminates the need for trusted third-party key delivery services, allowing manufacturers to independently complete key setup without waiting for external key distribution, thereby saving time and reducing overhead while maintaining security through cryptographic principles.
3Adaptability or versatility
If manufacturer configuration parameters are used for key derivation, then adaptability to different manufacturers is improved, but key management complexity increases
Solution Approach 1:
Each IoT device manufacturer has their own local MDP that is unique to their organization. This local quality approach allows each manufacturer to have customized key derivation parameters tailored to their specific security requirements and identity, while the overall system remains simple because the IC manufacturer's process remains unchanged and standardized.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A method of producing a secure integrated circuit (IC, 210), including: loading the IC with a unique identification number (UID, 215); loading the IC with a key derivation data (KDD, 220) that is based upon a secret value K and the UID; producing a secure application (240) configured with a manufacturer configuration parameter (MCP) and the secret value K and configured to receive the UID from the IC; producing a manufacturer diversification parameter (MDP, 250) based upon the MCP and the secret value K and loading the MDP into the IC; wherein secure IC is configured to calculate a device specific key (DSK) based upon the received MDP and the KDD, and wherein the secure application calculates the DSK based upon the MCP, K, and the received UID.