Dynamic Key Rotation for Secure Content Execution
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing secure execution environments are vulnerable to physical attacks, such as differential power analysis (DPA) attacks, which can reveal cryptographic keys used for decrypting and encrypting content, compromising security.
Innovation Solution
A method that involves receiving a first key from a secure element to decrypt content in an execution environment, and then receiving a second key to re-encrypt the content, modifying the keys each time the content is used, along with storing tokens in a non-shared memory zone to manage access and storage, thereby enhancing security against physical attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If cryptographic keys are stored in secure elements and transmitted to execution environments for content decryption, then access to encrypted content is enabled, but the execution environment becomes vulnerable to physical attacks such as DPA attacks that can reveal the cryptographic keys
Solution Approach 1:
The patent applies dynamics by making the cryptographic key variable rather than static. The key changes automatically after each content usage session, transforming the security model from a fixed key stored in secure elements to a dynamic key that evolves with each use. This prevents DPA attacks because the key trajectory over time changes, making differential power analysis ineffective.
Solution Approach 2:
The patent changes the parameter of the cryptographic key from a constant value to a variable value that changes after each usage. The key is not fixed but evolves based on usage history, which fundamentally alters the security landscape and prevents attackers from analyzing power consumption patterns to recover the key.
2Ease of operation
If the same cryptographic key is used repeatedly for decrypting and encrypting content, then operational simplicity is maintained, but security is compromised as the key can be revealed through physical attacks
Solution Approach 1:
The system automatically manages key dynamics without user intervention. After each content usage, the key is automatically updated and stored with metadata indicating its usage count. This dynamic key management maintains operational simplicity for the user while providing strong security through automated key evolution.
Solution Approach 2:
The system performs self-service key management by automatically updating keys after each usage without requiring manual intervention. The key management is transparent to the user, who simply uses the content as usual, while the system handles the complex key rotation and security maintenance autonomously.
3Speed
If cryptographic keys are stored in volatile memory of the execution environment, then key access is fast and simple, but security is reduced as the memory is not protected against physical attacks
Solution Approach 1:
The patent segments the memory into different types: volatile memory for fast access during active use, and non-volatile memory for secure long-term storage. The key is temporarily placed in volatile memory for fast access during content decryption, then automatically transferred to non-volatile memory after use. This segmentation allows both fast access during operation and security during storage.
Solution Approach 2:
The non-volatile memory acts as an intermediary between the volatile memory and the secure element. It provides a secure storage location that is not easily accessible to physical attacks, while still allowing fast key retrieval when needed. The intermediary memory layer balances the conflicting requirements of speed and security.
Data Source
AI summary
Disclosed are methods and systems of implementing a right over a content or contents. Various implementations may include means and operations for receiving, for example in an execution environment and from a secure element, a first key for implementing a right over an encrypted content; decrypting said content in said execution environment with the help of the first key; and implementing the right over the content in said execution environment. Various implementations may also include means and operations for receiving a second key in, for example, said execution environment, from the secure element; and encrypting said content in sad execution environment with the help of the second key.