Hardware Cryptographic Module Key Management
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
There is a need for computing devices to efficiently and securely generate and manage cryptographic keys for encrypting and decrypting data, as existing methods lack robustness in key management and security.
Innovation Solution
A cryptographic module within the computing device generates cryptographic keys by combining a received password with a random number, storing the association for retrieval, and entering a cryptographic state for secure data processing, while also detecting improper access attempts and deleting associations accordingly.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If cryptographic keys are generated and stored using conventional methods, then key management is simple, but security is insufficient against unauthorized access
Solution Approach 1:
The cryptographic key is segmented into multiple components: a password component and a hardware-generated random component. These segments are stored separately in different memory regions within the cryptographic module, with the random component being hardware-generated and protected from direct access. This segmentation enhances security while maintaining manageable key recovery processes.
Solution Approach 2:
The patent introduces an intermediary key recovery mechanism that acts as a mediator between the user and the cryptographic key. When the device is reset or accessed by a new owner, the key recovery code serves as an intermediary that can reconstruct the cryptographic key from stored components without requiring the original password or direct access to the key material. This intermediary mechanism provides secure key management during transitions.
2Reliability
If cryptographic keys are securely protected from access, then security is improved, but key recovery and device reset become difficult
Solution Approach 1:
The system performs preliminary actions by pre-generating and storing the hardware random component and associated metadata (such as encryption keys and initialization vectors) in secure memory regions during device initialization. This preliminary preparation enables rapid key recovery during device reset scenarios without requiring complex real-time computations or external interventions, thus maintaining both security and operational ease.
Solution Approach 2:
The cryptographic module is designed to be self-service capable during key recovery operations. The hardware random component and associated cryptographic parameters are stored within the module itself, enabling the module to autonomously reconstruct cryptographic keys during device reset without requiring external key management infrastructure or complex recovery procedures. The module uses its own internal secure elements to facilitate the recovery process.
3Reliability
If hardware cryptographic modules are used, then security is enhanced, but device complexity increases
Solution Approach 1:
The patent merges multiple cryptographic functions into a single integrated hardware module. The cryptographic module combines random number generation, key storage, key derivation, and encryption/decryption operations within one unified hardware unit. This merging approach enhances security by protecting sensitive operations within a single secure boundary while managing complexity through functional integration rather than separate components.
Solution Approach 2:
The cryptographic module is designed with universal functionality to perform multiple cryptographic operations: generating random numbers, deriving cryptographic keys from passwords, storing key material, and performing encryption/decryption. This multi-functionality reduces the need for separate hardware components for each cryptographic operation, thereby enhancing security through a unified secure module while managing overall device complexity.
Data Source
AI summary
A cryptographic module and a computing device implemented method for securing data using a cryptographic module is provided. The cryptographic module may include an input component for receiving a password, an output component for outputting data to the computing device, a random number generator for generating a random number and a module processor operative to generate at least one cryptographic key using the generated random number, and to record an association between the received password linking the received password with the at least one cryptographic key in a data store accessible to the cryptographic module.