Real-Time Encryption Key Update via Shadow Registers
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current compute systems face challenges in efficiently updating encryption keys in communication channels without disrupting ongoing operations, particularly in complex interconnect architectures where downtime is undesirable.
Innovation Solution
A method for real-time updating of encryption keys in compute systems involves generating an updated key, storing it in a shadow register, and sending a key update message to the remote processor, allowing for seamless switching with minimal disruption by pausing encrypted message transmission to allow the remote processor to activate the new key.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If encryption keys are updated by shutting down and restarting the communication channel, then the encryption keys can be successfully updated, but the communication channel experiences downtime and disruption
Solution Approach 1:
The patent applies preliminary action by pre-computing and storing updated encryption keys in a ready state before they are needed. The system prepares multiple key sets in advance, so when a key update is required, the transition can occur immediately without shutting down the communication channel, thus maintaining productivity while ensuring reliable key updates.
Solution Approach 2:
The patent uses an intermediary mechanism by introducing a key management entity that coordinates key updates between the communication channel and the encryption/decryption modules. This intermediary manages the transition of keys without requiring the communication channel itself to be shut down, resolving the contradiction between reliable key updates and continuous communication.
2Reliability
If the communication channel is shut down for key updates, then security is improved through key rotation, but system availability and operational continuity deteriorate
Solution Approach 1:
The patent implements continuity of useful action by enabling the communication channel to remain operational during encryption key updates. The system maintains active communication while background processes handle key generation, storage, and transition, ensuring that security updates occur without interrupting the useful action of data transmission.
Solution Approach 2:
By pre-computing and staging updated encryption keys before they are needed for rotation, the system eliminates downtime associated with key updates. The preliminary preparation of key material allows seamless transition without pausing communication, thus reducing loss of time while maintaining security through proper key rotation.
3Productivity
If encryption keys are updated in real-time without shutting down the channel, then communication continuity is maintained, but the complexity of key management increases
Solution Approach 1:
The patent introduces an intermediary key management entity that centralizes and simplifies the complexity of real-time key updates. This intermediary handles key generation, distribution, and coordination between communication modules, absorbing the management complexity while allowing the communication channel to maintain continuity without dealing with the intricacies of key rotation directly.
Solution Approach 2:
The system implements self-service by enabling the encryption and decryption modules to automatically use the appropriate key sets based on their current state, without requiring manual intervention or complex coordination during key updates. The modules autonomously transition between key sets, reducing the perceived complexity for external users while maintaining communication continuity.
Data Source
AI summary
Techniques for real-time updating of encryption keys are disclosed. In the illustrative embodiment, an encrypted link is established between a local and remote processor over a point-to-point interconnect. The encrypted link is operated for some time until the encryption key should be updated. The local processor sends a key update message to the remote processor notifying the remote processor of the change. The remote processor prepares for the change and sends a key update confirmation message to the local processor. The local processor then sends a key switch message to the remote processor. The local processor pauses transmission of encrypted message while the remote processor completes use of the encrypted message. After a pause, the local processor continues sending encrypted messages with the updated encryption key.