Microcontroller KEK Storage and Register Flag Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cryptographic key exchange systems face security risks due to the exposure of pre-shared keys to software, which can lead to system compromise, while public key exchange methods are computationally intensive and inefficient.
Innovation Solution
A microcontroller with on-chip key storage slots in non-volatile memory, where software selects which key to use, and a register flag determines whether the key is for data encryption/decryption or key encryption/decryption, ensuring secure storage and usage of the Key Encrypt Key (KEK) without exposing it to software.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If pre-shared keys are used for key exchange, then computational efficiency is improved, but security is worsened due to software access to keys
Solution Approach 1:
The patent extracts the key material from software-accessible memory and places it in hardware-protected storage within the cryptographic module. The KEK is stored in a dedicated secure storage location that is inaccessible to software, while still allowing the cryptographic module to access it for key derivation operations. This separation resolves the contradiction by maintaining security through physical isolation while preserving computational efficiency through hardware-accelerated key derivation.
Solution Approach 2:
The patent introduces a trusted hardware cryptographic module as an intermediary between the software system and the key material. This module contains secure storage for the KEK and performs key derivation operations internally, acting as a mediator that protects the key from software access while still enabling the cryptographic functionality required by the system. The intermediary approach allows pre-shared key efficiency to be maintained while eliminating software exposure risks.
2Reliability
If public key exchange protocols are used, then security is improved, but computational overhead is worsened
Solution Approach 1:
The patent applies preliminary action by pre-establishing a trusted Key Encrypting Key (KEK) in secure hardware storage before any cryptographic operations begin. This pre-configured key eliminates the need for computationally intensive public key exchange protocols during runtime, as the secure module can directly derive session keys from the pre-stored KEK. The security of public key exchange is achieved through the secure hardware storage, while the computational overhead is reduced by eliminating the need for asymmetric encryption operations during key establishment.
3Ease of operation
If software can access key storage, then ease of operation is improved, but security is worsened due to potential key exposure
Solution Approach 1:
The patent applies local quality by creating different access characteristics for different parts of the key storage system. The KEK is stored in a secure storage location with restricted access (inaccessible to software), while derived session keys are stored in accessible memory (accessible to software). This differentiated access structure allows software to operate with the derived keys for encryption/decryption while the master KEK remains protected, resolving the contradiction between ease of operation and security through localized access control.
Data Source
Figure 1~2A
Figure 2B~4
Figure 3
AI summary
A microcontroller includes on-chip key storage slots stored in a non-volatile memory, wherein selecting which key is to be used is restricted to software, wherein a predetermined key storage slot stores a Key Encrypt Key (KEK), and a register flag is provided for determining whether the predetermined key storage slot stores a key for encrypting/decrypting data or the KEK for encrypting/decrypting a key