Encrypted Keystore Data Structure for SoC Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Data storage devices face vulnerabilities due to the distribution of encryption keys and HMAC values across multiple memory locations, making them susceptible to unauthorized access and roll-back attacks, as older versions of data and security components can be exploited by attackers.
Innovation Solution
A hidden cryptographic key is stored within a System on Chip (SoC) device, used to encrypt a keystore data structure that combines encryption keys and HMAC values, ensuring they are stored in a single secure location, with periodic updates and secure erasure of previous versions to prevent access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If encryption keys and HMAC values are distributed across multiple memory locations, then data can be stored and accessed, but the system becomes susceptible to unauthorized access and roll-back attacks
Solution Approach 1:
The patent combines multiple encryption keys (first encryption key and second encryption key) and HMAC values into a single encrypted keystore data structure. This merging eliminates the security vulnerability of distributed key storage by consolidating all critical security parameters into one protected location, preventing attackers from accessing individual keys or performing roll-back attacks on older versions.
Solution Approach 2:
The patent implements a nested structure where encryption keys and HMAC values are embedded within an encrypted keystore data structure, which is itself protected by a second encryption key. This nested arrangement allows the system to maintain multiple layers of security while storing all keys in a single logical location, resolving the contradiction between security and structural complexity.
2Adaptability or versatility
If multiple versions of encryption keys are stored in memory, then historical data can be recovered, but attackers can exploit older versions to compromise security
Solution Approach 1:
The patent extracts the vulnerability of storing multiple key versions in memory by removing older key versions after they have served their purpose. The system maintains only the current encrypted keystore data structure in memory, while historical versions can be recovered from secure backup storage when needed. This extraction eliminates the attack surface for roll-back attacks while preserving data recovery capability.
Solution Approach 2:
The patent implements preliminary secure erasure of older keystore data structures before deploying new key versions. By proactively removing outdated security parameters from memory and applying secure erasure techniques, the system prevents attackers from exploiting historical versions while maintaining the ability to recover from backups if needed.
3Productivity
If encryption keys are stored in accessible memory locations, then data access is efficient, but unauthorized entities can access and tamper with the keys
Solution Approach 1:
The patent creates a composite security structure by encrypting the keystore data structure with a second encryption key that is protected by a hardware security module or secure element. This composite approach combines fast cryptographic operations with hardware-based protection, allowing efficient data access while preventing unauthorized key access. The encrypted keystore can be quickly decrypted for legitimate access while remaining protected against tampering.
Data Source
AI summary
Apparatus and method for data security through the use of an encrypted keystore data structure. In accordance with some embodiments, first and second sets of input data are respectively encrypted using first and second encryption keys to form corresponding first and second encrypted data sets. The first and second encryption keys are combined to form a string. A hidden key stored within a system on chip (SOC) is used to encrypt the string to form an encrypted keystore data structure, and the first and second encrypted data sets and the encrypted keystore data structure are stored in a memory.