Hierarchical Key Management for Offline Device Validation

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Current methods for preventing replacement and cloning attacks in computing systems, such as those using Transport Layer Security (TLS), are time-consuming and rely on external network connections, which are not always available, necessitating a faster and offline-capable validation method.

Innovation Solution

A hierarchical key management system network is implemented, utilizing a remote key management server (RKMS) and local key management servers (LKMS) to securely manage and validate public keys, ensuring device identity through digital signatures and nonces, allowing for faster key operations and offline validation.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If Transport Layer Security (TLS) is used to prevent replacement and cloning attacks, then security is improved, but validation time increases and external network dependency is introduced

Engineering Contradiction:

ImprovesecurityVSAvoidvalidation time

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

The system segments the key management functionality into local key management servers (LKMS) that operate independently within the network. Each LKMS maintains local key validation capabilities, eliminating the need for external TLS validation and enabling faster local operations while maintaining security through distributed trust anchors.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The patent introduces trusted trust anchors as intermediary components that are pre-deployed to local devices. These trust anchors serve as local mediators for key validation, replacing external TLS certificate authorities and enabling offline validation without sacrificing security.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Reliability

If Transport Layer Security (TLS) is used to prevent replacement and cloning attacks, then security is improved, but network connectivity requirement is introduced

Engineering Contradiction:

ImprovesecurityVSAvoidoffline capability

Core Design Contradiction:

ReliabilityVSAdaptability or versatility

Solution Approach 1:

The system performs preliminary action by pre-deploying trust anchors to local key management servers during device provisioning. These trust anchors are stored locally and enable offline validation operations without requiring real-time network connectivity to external certificate authorities.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The local key management servers perform self-service key validation using locally stored trust anchors. The system enables itself to validate keys offline without external network assistance, while still maintaining the security guarantees of formal verification through locally cached cryptographic materials.

Inventive Principle:

Principle #25Self-service

Data Source

PatentUS20240267233A1Trusted network to prevent replacement and cloning attacks

Publication Date: 2024.08.08 MICRON TECHNOLOGY INC

AI summary

In some aspects, the techniques described herein relate to a system including: a remote key management server (RKMS); and a computer network communicatively coupled to the RKMS, the computer network including: a first computing device a second computing device, and a local key management server (LKMS) communicatively coupled to the RKMS, the first computing device, and the second computing device, wherein the LKMS is configured to: writes a LKMS public key to the first computing device using a command signed by the RKMS, write a public key of the second computing device to the first computing device using a second command signed using a private key corresponding to the LKMS public key.