Key Tunnel Unit for Secure Session-Key Delivery
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The delivery of encryption keys from a central Root-of-Trust (RoT) to crypto engines over a public bus is risky due to untrusted micro-controller units and the significant distance, making dedicated wires or buses expensive and insecure.
Innovation Solution
A key tunnel unit (KTU) is used to wrap and unwrap session keys in hardware, ensuring they are not exposed to untrusted software, using a sequence of wrapping keys to secure transmission over a public bus.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If dedicated wires or a dedicated bus are used for key delivery, then key delivery security is improved, but device cost and complexity increase
Solution Approach 1:
A key tunnel unit (KTU) is introduced as an intermediary hardware component between the root of trust and the crypto engine. The KTU receives wrapped keys from the root of trust, unwraps them using a wrapping key, and delivers the session keys to the crypto engine. This mediator approach allows secure key delivery over existing public buses without requiring dedicated secure wiring, thus resolving the contradiction between security and complexity.
Solution Approach 2:
The key delivery function is segmented into separate components: the root of trust generates and wraps session keys, the key tunnel unit receives and unwraps them, and the crypto engine uses the session keys for encryption. This segmentation allows each component to perform its function securely without requiring a dedicated bus, as the wrapping key protects the session keys during transmission over the public bus.
2Device complexity
If keys are sent over a public bus to avoid dedicated wires, then device cost is reduced, but security against attacks increases
Solution Approach 1:
Before transmitting session keys over the public bus, the root of trust performs preliminary wrapping of the session keys using a wrapping key. This preliminary encryption action ensures that even though the keys traverse the unsecured public bus, they remain protected. The key tunnel unit then unwraps the keys at the destination, completing the secure delivery process.
Solution Approach 2:
The key tunnel unit acts as a secure intermediary that bridges the untrusted public bus and the crypto engine. It receives wrapped keys from the root of trust, unwraps them using the wrapping key, and delivers the session keys to the crypto engine. This intermediary approach allows the system to use the existing public bus while maintaining security through hardware-based key protection.
3Ease of operation
If an MCU is used to manage crypto engines, then ease of operation is improved, but trustworthiness and key access security worsen
Solution Approach 1:
The key management function is extracted from the untrusted MCU and placed into dedicated hardware components: the root of trust for key generation and wrapping, and the key tunnel unit for key unwrapping and delivery. This extraction ensures that even though the MCU can manage and control these components, it cannot access the actual session keys, thereby resolving the contradiction between ease of management and security.
Solution Approach 2:
The key tunnel unit serves as a hardware intermediary between the MCU and the crypto engine. It receives wrapped keys from the root of trust, unwraps them using the wrapping key, and delivers the session keys to the crypto engine. This hardware mediator approach allows the MCU to manage the system operationally while maintaining security, as the keys never expose to the software running on the untrusted MCU.
Data Source
AI summary
Approaches in accordance with various illustrative embodiments provide for the encryption of communications going into and out of a device, such as a chip or proprietary bus. The encryption can occur in a central Root-of-Trust (RoT), which can include agents for individual communication protocols to generate session keys used to encrypt communications for individual sessions, and the data can be sent to a crypto engine for the respective communication protocol. A key tunnel unit can be used to receive a wrapped session key over the public bus and then unwrap the key in hardware, then able to then transmit the unwrapped session key to the corresponding crypto engine without exposing the session key to software executing on the device outside the RoT. The receiving inline crypto engine can then use that session key to encrypt session data to be transmitted to a separate device or destination.