IC Root Secret Embedded Key Generation for IoT Provisioning
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
IoT devices face challenges in generating a verified and diversified public key pair in an unsecure environment without relying on costly public key infrastructure, especially since there is no direct trust relationship between IC manufacturers and customers, and existing methods are complex and costly.
Innovation Solution
An IC manufacturer embeds a hard-coded root secret and unique identifier in each IC, allowing the IC to generate a public/private key pair, which is then verified using a reference IC with the same root secret, enabling secure provisioning without a public key infrastructure, even over an untrusted network.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a public key infrastructure is used to provide authentication and verification, then security and verification capability are improved, but cost and system complexity increase significantly
Solution Approach 1:
The patent extracts the essential verification function from the complex public key infrastructure and implements it directly in the IC hardware through embedded root secrets and unique identifiers. This removes the need for external PKI services, certificates, and continuous internet connection requirements, thereby reducing system complexity while maintaining verification capability.
Solution Approach 2:
The IC device performs self-verification by using its embedded unique identifier and root secret to generate and verify public keys locally without requiring external authentication services. This self-service approach eliminates the need for costly third-party PKI infrastructure while maintaining security and verification capabilities.
2Ease of manufacture
If key generation is performed in an unsecure environment, then manufacturing flexibility and cost are improved, but security and verification reliability deteriorate
Solution Approach 1:
The patent implements preliminary action by embedding the root secret and unique identifier directly into the IC during manufacturing before the device is deployed. This pre-provisioning of cryptographic materials in a controlled manufacturing environment ensures that key generation can later occur in unsecure environments while maintaining security, as the critical secret materials are already securely embedded in the hardware.
3Reliability
If direct trust relationship between IC manufacturer and customer is established, then security and verification are improved, but business model flexibility and scalability worsen
Solution Approach 1:
The patent introduces an intermediary element - the embedded unique identifier and root secret in the IC itself - that enables verification without requiring a direct trust relationship between manufacturer and customer. The IC acts as a self-contained verification entity that can be authenticated by any party possessing the corresponding verification key, thereby enabling flexible business models with multiple distributors and customers while maintaining security.
Data Source
AI summary
A method is provided for generating a public/private key pair on an IC and to provision an IoT device having the IC. In the method, a first entity manufacturers an integrated circuit (IC) for use in a device. The IC, or chip, has a root secret embedded therein. A public key is generated on the IC using a unique identifier (ID) and the root secret. The IC is provided to a second entity for manufacturing the device using the IC. A reference IC is provided to a third entity. The reference IC has the same embedded root secret as the IC. The reference IC is configured to use the unique ID of the IC and the embedded root secret to generate a derived public key. The third entity is enabled to verify that the public key of the IC is associated with the unique ID by using the derived public key of the reference IC. The method allows the IoT device to be provisioned without using a public key infrastructure.