Keying Infrastructure for Cryptographic Key Management
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
There is an increasing need to protect cryptographic keys from unauthorized access as devices increasingly rely on them for security and authentication, but existing technologies have limitations in managing and generating these keys effectively.
Innovation Solution
A keying infrastructure that uses a key derivation function (KDF) to generate and manage cryptographic key hierarchies, including identity and encryption keys, where each key in the hierarchy is derived from a preceding key and then deleted to prevent unauthorized access, and keys are distributed based on components and security configurations to enhance protection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If cryptographic keys are stored in devices for security operations, then security functionality is enabled, but unauthorized access and key compromise risk increase
Solution Approach 1:
The patent segments the cryptographic key storage and management into distinct components: secure enclaves for key storage, key derivation functions for key generation, and controlled access mechanisms. This segmentation isolates keys from general system access, enabling security functionality while reducing unauthorized access risk through physical and logical separation.
Solution Approach 2:
The patent introduces key derivation functions and secure enclaves as intermediaries between the cryptographic keys and the system components that need them. These intermediaries control key access without exposing the actual keys, enabling security operations while preventing direct unauthorized access to the key material.
2Ease of operation
If cryptographic keys are made accessible to device components for operations, then operational capability is enabled, but key exposure and compromise vulnerability increase
Solution Approach 1:
The patent extracts the cryptographic keys from general system memory and places them in secure enclaves with restricted access. This extraction allows operational components to access keys only through controlled interfaces, enabling necessary operations while reducing exposure vulnerability by removing keys from the general accessible memory space.
Solution Approach 2:
The patent implements different access qualities for different system components: full access for authorized secure operations, controlled access for verification purposes, and no access for unrelated components. This local quality differentiation enables operational capability where needed while minimizing key exposure vulnerability in other areas of the system.
3Device complexity
If a single cryptographic key is used for multiple security operations, then system simplicity is maintained, but security risk from key compromise increases
Solution Approach 1:
The patent implements dynamic key derivation where keys are generated on-demand based on operational context, component identity, and security parameters. This dynamic approach replaces static single-key systems with adaptive key generation that maintains security resilience by providing different keys for different operations while keeping the overall system manageable through automated derivation.
Solution Approach 2:
The patent changes key parameters (derivation inputs, security levels, access conditions) based on operational context rather than using a fixed key. This parameter-based approach maintains security resilience by adapting key characteristics to specific operations while keeping key management simple through systematic parameter control rather than manual key distribution.
4Object-affected harmful factors
If cryptographic keys are protected with strict access controls, then unauthorized access is prevented, but legitimate operation overhead increases
Solution Approach 1:
The patent performs preliminary key derivation and authentication setup during system initialization and component boot sequences. This preliminary action establishes trusted relationships and cached authentication states before operational keys are needed, preventing unauthorized access through pre-validated security checks while reducing operational overhead by avoiding repeated full authentication cycles.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A keying infrastructure may generate and/or manage cryptographic keys. The cryptographic keys may include identity keys, encryption keys, and a variety of other types of keys. The cryptographic keys may be derived or created with a key derivation function (KDF) or other one-way function. The cryptographic keys may include keys that are accessible to a boot loader, keys that are accessible to particular components of a Trusted Execution Environment (TrEE), and so on. In some examples, a key may be derived from a preceding key in a sequence of keys. The preceding key may be deleted when the key is derived.