Masked Cryptographic Keys for Volatile Root-Key Erasure
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Cryptographic keys stored in non-volatile memory are vulnerable to unauthorized access and tampering, as existing systems lack the ability to securely destroy keys without a constant power supply.
Innovation Solution
Storing cryptographic keys in a masked form using a bitwise exclusive disjunction operation with a device root key, where the device root key is stored in volatile memory and erased upon detecting tampering, ensuring all keys are securely destroyed.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Duration of action of stationary object
If cryptographic keys are stored in non-volatile memory, then key persistence and availability are improved, but security against unauthorized access and tampering deteriorates
Solution Approach 1:
The cryptographic key is segmented into multiple shares using secret sharing schemes (e.g., Shamir's Secret Sharing). Each share is stored in a separate location or protected by different security mechanisms. The key can only be reconstructed when a sufficient number of shares are combined, preventing unauthorized access even if some shares are compromised.
Solution Approach 2:
An intermediary protection mechanism (such as a trusted platform module, hardware security module, or cryptographic protocol) is introduced between the key storage and access operations. This intermediary verifies authentication, enforces access policies, and prevents direct access to the raw key material in non-volatile memory.
2Object-affected harmful factors
If cryptographic keys are stored in volatile memory, then security against tampering is improved through easy destruction, but key persistence and availability deteriorate
Solution Approach 1:
Keys are pre-loaded into volatile memory in a secure environment (such as during device manufacturing or initialization) before the system becomes operational. The keys remain in volatile memory only for the duration needed and are automatically cleared when power is removed or a security event occurs, ensuring they cannot be extracted or tampered with.
Solution Approach 2:
The system dynamically changes the state of key storage between volatile and non-volatile memory based on operational requirements and security conditions. During active use, keys reside in volatile memory for fast access and easy destruction. When not in use, encrypted versions or key shares are stored in non-volatile memory, transitioning between states based on security parameters.
3Object-affected harmful factors
If cryptographic keys are masked using device root key, then security against unauthorized access is improved, but system complexity increases
Solution Approach 1:
The device root key is merged with the cryptographic key through cryptographic operations (such as XOR masking or encryption) to create a protected key representation. This combining operation is simple to implement but provides strong security, as the original key cannot be recovered without the root key.
Solution Approach 2:
The system performs self-service key protection by automatically applying the masking operation using the device root key during key generation and storage. The same root key is used to both protect and potentially restore keys, eliminating the need for separate key management infrastructure and reducing overall system complexity.
Data Source
AI summary
Systems and methods for protecting cryptographic keys stored in a non-volatile memory. An example method may comprise: storing a device root key in a non-volatile memory; storing a volatile key in a volatile memory; storing a masked cryptographic key in the non-volatile memory, wherein the masked cryptographic key is produced by combining a cryptographic key and the device root key; storing a masked device root key in the non-volatile memory, wherein the masked root key is produced by combining the device root key and the volatile key; and erasing the device root key from the non-volatile memory.