HSM Key Caching via Volatile Attribute Pre-fetching
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network traffic management systems face challenges in efficiently handling cryptographic operations, particularly in client-server architectures with increasing complexity and interconnected devices, leading to performance, availability, and security issues.
Innovation Solution
The implementation of a multi-threaded software routine that offloads cryptographic functions to an external Hardware Security Module (HSM), using a data structure to store and manage key and session information, thereby reducing the need for repeated queries to the HSM and enhancing processing efficiency.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If cryptographic operations are performed using external HSM for each request, then security is improved, but processing time increases and system performance deteriorates
Solution Approach 1:
The patent applies preliminary action by pre-fetching volatile attributes (key handles) from the HSM and storing them in a data structure before they are needed for cryptographic operations. This allows subsequent operations to use the cached attributes without repeated HSM queries, thus maintaining security while improving processing speed.
Solution Approach 2:
The patent introduces an intermediary data structure that sits between the application and the HSM. This data structure caches volatile attributes and manages key information, acting as a mediator that reduces direct communication overhead with the HSM while maintaining the security architecture.
2Reliability
If repeated queries are made to HSM for volatile attributes, then security is maintained, but bandwidth consumption increases and processing efficiency decreases
Solution Approach 1:
The system performs preliminary action by caching volatile attributes (key handles) in a data structure after the first HSM query. Subsequent cryptographic operations reuse these cached attributes, eliminating repeated bandwidth-consuming queries to the HSM while maintaining security through proper attribute validation.
Solution Approach 2:
The patent creates copies of volatile attributes (key handles) and stores them in the data structure. These copies allow multiple operations to reference the same key information without requiring additional queries to the HSM, thereby reducing bandwidth consumption while preserving security through controlled access.
3Productivity
If volatile attributes are cached externally to reduce HSM queries, then processing speed improves, but system complexity increases
Solution Approach 1:
The data structure serves multiple functions: it stores volatile attributes (key handles), maintains persistent attributes (key identifiers), and manages the mapping between applications and cryptographic keys. This multi-functionality reduces the need for separate management systems while improving processing speed through efficient attribute access.
Solution Approach 2:
The data structure acts as an intermediary layer between applications and the HSM, providing a simplified interface that caches volatile attributes. This intermediary manages the complexity internally while presenting a simple access mechanism to applications, thus improving processing speed without proportionally increasing visible system complexity.
4Productivity
If multiple applications share the same HSM, then resource utilization improves, but access conflicts increase and availability decreases
Solution Approach 1:
The patent applies preliminary action by pre-caching volatile attributes for each application in the data structure. This allows multiple applications to simultaneously access their cached attributes without conflicting HSM queries, improving availability while maintaining high resource utilization through efficient HSM usage.
Solution Approach 2:
The data structure segments the storage of volatile attributes by application, with each application having its own cached key handles and associated metadata. This segmentation isolates access patterns for different applications, reducing access conflicts and improving availability while allowing the HSM to efficiently serve multiple applications through the cached data.
Data Source
Figure 1A
Figure 1B
Figure 2
AI summary
Technology related to accessing security hardware keys is disclosed. In one example, a method includes receiving an initial request to perform a first cryptographic operation using a key stored in security hardware circuitry. In response to servicing the initial request, a persistent attribute of the key can be used to query the security hardware circuitry to receive a volatile attribute of the key. The volatile attribute of the key can be stored external to the security hardware circuitry to enable subsequent requests to perform cryptographic operations on the security hardware circuitry without querying the security hardware circuitry for the volatile attribute of the key. A subsequent request referencing the key can be received. The subsequent request can be serviced by using the security hardware circuitry and identifying the key using the stored volatile attribute of the key without querying the security hardware circuitry for the volatile attribute of the key.