Key Distribution System Using Segmented Tables and Private Bus
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing key management systems face challenges in securely storing, distributing, and managing large numbers of symmetric keys, which are resource-intensive and vulnerable to security breaches due to external storage and access.
Innovation Solution
A key distribution system (KDS) that utilizes isolated internal memory and a private bus to provide secure key storage and distribution, limiting access to software and firmware, and enabling rapid key population during boot without CPU communication, while also providing hardware protection and access to crypto accelerations for load balancing.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If keys are stored on external or remote systems, then key management flexibility is improved, but security is worsened due to vulnerability to unauthorized access
Solution Approach 1:
The system segments key storage into multiple isolated key tables (e.g., KEY_TABLE_0 through KEY_TABLE_7) distributed across different memory regions. Each key table is protected by its own policy table and access control mechanisms, allowing flexible key management while maintaining security through physical and logical separation of key materials.
Solution Approach 2:
The patent introduces policy tables as intermediary structures that mediate between key storage and access requests. These policy tables contain access control information and act as a security layer between the external system and the actual key data, enabling flexible access policies while preventing unauthorized access to the underlying key materials.
2Adaptability or versatility
If thousands of symmetric keys are stored on system memory, then key functionality is improved, but memory space is worsened by occupying considerable space
Solution Approach 1:
The system divides the large number of keys into multiple segmented key tables, each managing a subset of keys. This segmentation allows efficient memory utilization by only loading and maintaining keys that are currently needed, rather than keeping all thousands of keys in memory simultaneously, thus reducing the memory footprint while maintaining full key functionality.
Solution Approach 2:
The patent implements partial key population where only the necessary subset of keys is loaded into memory at any given time, rather than loading all possible keys. The system dynamically loads keys based on demand and invalidates or removes keys that are no longer needed, reducing memory occupancy while ensuring all required key operations can be performed.
3Reliability
If keys are secured with hardware protection, then security is improved, but access complexity is worsened by limiting software and firmware access
Solution Approach 1:
The policy tables serve as intermediary structures that manage the complexity of hardware-protected key access. They contain access control information that mediates between security requirements and software/firmware access needs, allowing the system to maintain strong hardware protection while providing controlled access paths for authorized software and firmware components without requiring complex access management logic.
4Ease of operation
If key population is performed during boot time, then key availability is improved, but processing time is worsened by being resource and time intensive
Solution Approach 1:
The system performs partial key population during boot time, loading only the essential subset of keys needed for initial system operation rather than populating all thousands of keys. This approach ensures key availability for critical functions while significantly reducing the time and resources consumed during the boot process. Additional keys can be loaded on-demand as needed during system operation.
Data Source
Figure 1A
Figure 1B
Figure 2
AI summary
Systems and methods are directed toward key distribution systems and methods. A key distribution system may include a policy table and a key table to develop different policy regions for various associated managers and then map memory address locations to table locations for the policy regions. The policy regions may be established using different parameters and then locked after activation to prevent further editing or modification after creation. When activated, users and owners may then access the associated memory addresses associated with authorized active policy regions.