Cryptographic Entropy Tree for Secure Key Storage

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Computing devices face limitations in securely storing and managing cryptographic keys due to limited storage capacity in secure enclave processors (SEPs), which restricts the number of keys that can be stored and accessed securely.

Innovation Solution

The system extends key storage by encrypting keys in accessible device storage, using a secure enclave processor to encrypt and decrypt keys, and employing entropy to generate unique keys for each user and service instance, allowing separate encryption and isolation of keys, thereby preventing unauthorized access.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If keys are stored in SEP memory to ensure security, then security is improved, but storage capacity is limited

Engineering Contradiction:

ImprovesecurityVSAvoidnumber of keys that can be stored

Core Design Contradiction:

ReliabilityVSQuantity of substance

Solution Approach 1:

The patent segments the key storage system into two parts: a small secure SEP memory for storing entropy values and a larger accessible device storage for storing encrypted keys. This segmentation allows the system to maintain high security for critical cryptographic materials while enabling storage of many more keys in the accessible storage space.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The patent introduces entropy values as an intermediary cryptographic material stored in SEP memory. These entropy values are used to derive actual encryption keys, allowing the system to store only small entropy values securely while generating numerous derived keys for storage in accessible storage, thus resolving the contradiction between secure storage and key quantity.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Quantity of substance

If multiple users share the same device storage, then storage capacity is improved, but key isolation between users deteriorates

Engineering Contradiction:

Improvestorage capacityVSAvoidkey isolation

Core Design Contradiction:

Quantity of substanceVSReliability

Solution Approach 1:

The patent applies local quality by deriving unique encryption keys for each user from common entropy values stored in SEP memory. Each user's key is locally customized through the key derivation process using user-specific identifiers, ensuring that while all users share the same physical storage, each user's cryptographic materials remain isolated and secure from other users.

Inventive Principle:

Principle #3Local quality

3Quantity of substance

If entropy values are stored in accessible device storage, then storage capacity is improved, but security against unauthorized access deteriorates

Engineering Contradiction:

Improvestorage capacityVSAvoidunauthorized access to entropy values

Core Design Contradiction:

Quantity of substanceVSObject-affected harmful factors

Solution Approach 1:

The patent extracts the most critical cryptographic material (entropy values) from accessible device storage and places it exclusively in the secure SEP memory. Only the less sensitive encrypted keys are stored in accessible storage. This extraction ensures that the most valuable cryptographic secrets remain protected in hardware-isolated secure memory while enabling large-scale key storage.

Inventive Principle:

Principle #2Taking out (Extraction)

Data Source

PatentUS10320563B2Cryptographic entropy tree

Publication Date: 2019.06.11 APPLE INC

AI summary

A device may include a secure processor and a secure memory coupled to the secure processor. The secure memory may be inaccessible to other device systems. The secure processor may store some keys and/or entropy values in the secure memory and other keys and/or entropy values outside the secure memory. The keys and/or entropy values stored outside the secure memory may be encrypted using information stored inside the secure memory.