IoT Device Key Pair Generation Using Unique Identifier and Secret Key Derivation Data
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for generating public/private key pairs and certificates for IoT devices using integrated circuits are complex and require secure environments or trusted relationships, which are challenging for low-cost ICs and contract manufacturing scenarios, especially when untrusted third parties are involved.
Innovation Solution
A method involving a multi-party shared secret generation algorithm, such as elliptic curve Diffie-Hellman, where a unique identifier and secret key derivation data are loaded onto ICs, enabling secure key derivation and certificate generation in an untrusted environment, allowing for the creation of signed public key certificates without requiring a live internet connection or secure environments.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If existing key provisioning methods are used, then security is maintained through trusted relationships and secure environments, but device complexity and manufacturing cost increase
Solution Approach 1:
The IC performs self-provisioning by generating its own key pair and certificate using the embedded UID and KDD, eliminating the need for external provisioning servers or secure manufacturing environments. The device autonomously completes the cryptographic setup process that previously required trusted third parties and secure infrastructure.
Solution Approach 2:
The UID and KDD are pre-loaded onto the IC during manufacturing, enabling the device to perform key generation and certificate creation independently later. This preliminary preparation of cryptographic materials allows the IC to self-provision without requiring secure environments or external assistance during the actual key provisioning process.
2Reliability
If secure environments and provisioning servers are required, then key generation is secure, but manufacturing cost and infrastructure requirements increase
Solution Approach 1:
The IC autonomously generates its own key pair and certificate using pre-loaded cryptographic materials, eliminating the need for external provisioning servers and secure manufacturing environments. This self-service approach secures key generation while reducing infrastructure costs and manufacturing complexity.
Solution Approach 2:
The UID and KDD serve as intermediary elements that enable secure key generation without requiring secure environments. These pre-loaded cryptographic materials act as mediators that allow the IC to perform secure key provisioning independently, replacing the need for provisioning servers and secure facilities.
3Adaptability or versatility
If uncustomized ICs are used with contract manufacturing, then manufacturing flexibility increases, but security verification becomes difficult
Solution Approach 1:
Each IC independently generates its own key pair and certificate using its unique UID and KDD, enabling security verification without requiring trusted relationships with contract manufacturers. The self-service approach allows any manufacturer to produce secure devices using standard ICs, maintaining both manufacturing flexibility and security verification.
Solution Approach 2:
The UID and KDD are unique to each IC, creating individual cryptographic parameters that enable verification of each device's authenticity. This parameter differentiation allows security verification of individually manufactured devices while maintaining flexibility in the manufacturing process through contract manufacturers.
4Reliability
If True Random Number Generators are included in low-cost ICs, then key generation quality improves, but manufacturing cost increases
Solution Approach 1:
The UID and KDD are pre-generated and loaded onto the IC during manufacturing, serving as pre-prepared cryptographic materials. This preliminary action provides the foundation for secure key generation without requiring a TRNG in the final device, maintaining low cost while ensuring key quality through the use of pre-loaded cryptographic parameters.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A method is provided for generating a key pair and certificate for an IoT device. An integrated circuit (IC) is manufactured by a first entity for use in an internet of things (IoT) device. The IC is provided to a second entity for manufacturing the loT device using the IC, the IC having a unique identifier (UID) and secret key derivation data (KDD). A secure memory is provided to a third entity by the first entity. The secure memory has secret key derivation parameters configured to enable the generation of a product specific parameter (PSP). The secure memory enables the third entity to prepare a signed public key certificate using the UID assigned to the IC of each device. The public key certificate is for verifying the authenticity of the device. In addition, the PSP enables the IC inside the device to generate a private key corresponding to a public key in the signed public key certificate.