Field Device Root Key Generation via Secure Processor
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The generation of device root keys, particularly RSA keys, is time-consuming and costly in high-volume production, and existing methods face challenges in securely injecting and managing these keys in devices with limited on-chip memory and advanced CMOS digital processes.
Innovation Solution
The method involves on-demand field generation of device root keys using algorithms like DSA or ECDSA, with the device generating keys and securely storing them, and external key injection using secure servers for mutual authentication and secure communication to minimize processing time and logistical complexities.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If RSA root keys are generated during device manufacturing, then security authenticity is ensured, but manufacturing time and cost increase significantly
Solution Approach 1:
The patent generates RSA root keys in advance during device manufacturing and stores them in secure on-chip memory before the device is deployed. This preliminary key generation ensures that when the device is activated, the root key is already available for immediate use in establishing secure communications, eliminating the need for time-consuming key generation during initial system setup or field deployment.
Solution Approach 2:
The device incorporates a secure processor with integrated key generation capabilities that automatically generates and stores root keys during manufacturing without requiring external intervention. The device serves itself by using its own hardware resources (secure processor, random number generator, memory) to create and protect its cryptographic keys independently, reducing dependency on external key injection systems.
2Productivity
If keys are injected into devices externally, then manufacturing time is reduced, but security assurance becomes more complex
Solution Approach 1:
The patent introduces a secure processor as an intermediary component between external key injection systems and the device's cryptographic functions. This secure processor acts as a trusted mediator that receives keys from external sources, validates their integrity, and securely stores them in isolated memory regions. The secure processor handles all security-critical operations internally, shielding the rest of the system from security complexity while enabling external key injection.
3Volume of moving object
If devices have limited on-chip memory, then device size and cost are reduced, but key storage and management become more difficult
Solution Approach 1:
The patent implements different memory architectures with specialized regions for key storage. Critical root keys are stored in secure, isolated memory regions within the secure processor, while derivative keys and cryptographic material are managed in separate memory spaces. This local quality approach ensures that limited on-chip memory is used efficiently and securely, with key management responsibilities distributed across different memory regions rather than concentrated in a single large storage area.
Data Source
AI summary
Methods and systems for secure key generation are provided. In embodiments, during the manufacturing process, a device generates a primary seed for the device and stores the seed within the device. The device exports the device primary key to a secure manufacturer server. The secure manufacturer server generates a public/private root key for the device and requests a certificate for the public root key of the device from a certificate authority. The device, having the stored primary seed, is integrated into an end-user system. Upon occurrence of a condition, the device after integration into the end-user system generates the public/private root key in the field. The system also receives and installs the certificate for the public root key.