Hardware Key Manager for Per-File Flash Encryption
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Mobile devices face challenges in efficiently performing per-file encryption due to the limited number of keys available in the host controller interface's key table, leading to lag and potential vulnerabilities from software accessing encryption keys.
Innovation Solution
Implementing a hardware key manager on the SoC to generate an unlimited number of child keys from a base key using a nonce, with separate communication buses to the host controller interface, ensuring hardware-generated keys are used for encryption and decryption, and an arbiter to manage communications.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If software-based key management is used in the host controller interface, then key generation is flexible, but security vulnerabilities increase and performance lag occurs
Solution Approach 1:
The patent replaces software-based key management with a hardware-based key manager integrated into the host controller interface. The hardware key manager generates encryption keys through cryptographic operations performed in hardware, eliminating the security vulnerabilities and performance lag associated with software-based approaches. The key manager includes a cryptographic engine that performs key generation, encryption, and decryption operations directly in hardware, providing both security and performance benefits.
2Adaptability or versatility
If the key table in the host controller interface is used for per-file encryption, then encryption is enabled, but the limited number of keys causes performance lag
Solution Approach 1:
The hardware key manager performs preliminary key generation actions by pre-generating and storing multiple encryption keys in its internal key storage before they are needed for encryption operations. This allows the system to quickly switch between keys for different files without the performance lag that occurs when keys must be generated on-demand from a limited key table. The key manager can maintain a larger pool of pre-generated keys than the traditional key table allows.
3Adaptability or versatility
If third-party flash storage controllers are used, then device compatibility is improved, but customization for hardware-based encryption is not available
Solution Approach 1:
The patent merges the functionality of a third-party flash storage controller with a hardware-based key manager into a single integrated host controller interface. This combination allows the system to use standard third-party controllers for flash storage while simultaneously incorporating custom hardware-based encryption capabilities. The key manager is integrated into the host controller interface, allowing it to work with standard flash storage controllers while providing customized hardware-based encryption functionality that would not be available in off-the-shelf controllers.
Data Source
AI summary
Hardware-generated encryption keys are provided to enable per-file encryption of files to be stored in flash storage in a mobile device. Hardware-generated encryption keys are also used to decrypt encrypted files stored in the flash storage. A hardware key manager is configured to provide an unlimited number of child keys generated from one or more base keys. A nonce is applied to a base key to generate the child key. The hardware key manager communicates the child key to a host controller interface via a first bus. Software on the mobile device does not have access to the value of the child keys. A flash storage driver communicates commands to the host controller interface via a second bus. The host controller interface includes a cryptographic engine that utilizes the child keys to encrypt data to be written to the flash storage or decrypt data read from the flash storage.