Hardware-anchored key derivation for embedded security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for securing cryptographic keys in embedded control systems, such as those using Systems on Chip (SoC), are inadequate as they lack robust protection against attacks, particularly since key material is often stored in software or external authentication chips that can be easily intercepted or manipulated.
Innovation Solution
A method for securely providing a derived key within a digital circuit area, where a requesting unit specifies a first parameter but not a second parameter, which is determined by a provision unit, using a key derivation function to generate a key that is hardware-anchored, preventing unauthorized access and misuse.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If cryptographic keys are stored in software or external authentication chips, then key management is simplified, but security protection against attacks is weakened
Solution Approach 1:
The secret key is extracted from the requesting unit and stored exclusively in the provision unit. The requesting unit can request derived keys but cannot access the secret key itself, separating key generation capabilities from key usage capabilities to prevent attacks on the secret key while maintaining operational simplicity.
Solution Approach 2:
A key derivation function acts as an intermediary between the secret key and the derived keys needed by the requesting unit. This mediator transforms the secret key into usable derived keys without exposing the secret key itself, thereby maintaining both security and ease of key management.
2Reliability
If a companion chip is used for authentication, then authorization checking is enhanced, but the data interface becomes easily accessible to attackers
Solution Approach 1:
The provision unit is integrated into the same digital circuit area as the requesting unit, merging the authentication functionality into the main system rather than using a separate external chip. This integration eliminates the vulnerable external data interface while maintaining authorization checking capabilities within the protected digital circuit boundary.
3Reliability
If key material is hidden using white box cryptography, then software-based protection is improved, but the software remains easily attackable and manipulable
Solution Approach 1:
The patent replaces software-based key protection mechanisms with hardware-based protection by storing the secret key in a provision unit implemented in digital circuit logic. This substitution moves key protection from the vulnerable software domain to the more secure hardware domain, making the system resistant to software attacks while maintaining manageable complexity.
Data Source
Figure 1~2
AI summary
The invention relates to a method and a digital circuit for the secure provision of a key, comprising a request unit and a provision unit. A key is derived from parameters, at least one of which is used for key derivation in a manner unpredictable by the request unit. The key derivation takes place on a digital circuit where the request unit and the provision unit are implemented.