Multi-Stage Encryption Key Generation for Secure Portable Devices
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional smaller devices have limited security due to small encryption keys, which are insufficient for modern data storage and digital rights management requirements, especially given the limited die area of device components.
Innovation Solution
A method to generate a more robust encryption key by performing a multi-stage encryption process using repurposed data, such as a secret key and a unique device identifier, which increases security and makes reverse engineering more difficult, while occupying minimal die space.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a larger encryption key is used to improve security, then security robustness is improved, but die area occupied by the key increases
Solution Approach 1:
The patent applies nesting by embedding multiple layers of encryption within a compact key structure. The encryption key is divided into multiple components (first encryption key, second encryption key, and encrypted data) that are nested together in a way that allows the larger effective key space to be stored within a constrained die area. The first encryption key encrypts the second encryption key, which in turn encrypts the data, creating a nested encryption hierarchy that maximizes security within space limitations.
Solution Approach 2:
The encryption key is segmented into multiple distinct components rather than using a single large key. The key is divided into a first encryption key, a second encryption key, and encrypted data portions. This segmentation allows each component to be optimized for its specific function while collectively providing robust security. The segmentation enables the system to distribute the key material across multiple storage locations within the die, reducing the space requirement for any single key component.
2Reliability
If more data is stored in fuses to generate a robust key, then security is improved, but the amount of additional data required increases
Solution Approach 1:
The patent changes the parameters of the encryption process by using asymmetric encryption algorithms with specific key lengths (e.g., 128-bit or 256-bit keys). By optimizing the encryption parameters, the system achieves robust security with a relatively small amount of additional data stored in fuses. The parameter changes include selecting appropriate encryption algorithms, key lengths, and padding schemes that maximize security efficiency.
Solution Approach 2:
The system creates a copy of the encryption key material through the encryption process itself. When data is encrypted using the first and second encryption keys, the encrypted output serves as a copy that contains the necessary key information in an obfuscated form. This copying mechanism allows the system to derive the effective key from the encrypted data without requiring additional storage of the full key material, thereby reducing the quantity of additional data needed in fuses.
Data Source
AI summary
A method, system on a chip, and computer system for generating more robust keys which utilize data occupying relatively small die areas is disclosed. Embodiments provide a convenient and effective mechanism for generating a key for use in securing data on a portable electronic device, where the key is generated from repurposed data and a relatively small amount. A multi-stage encryption algorithm may be performed to generate the key, where the first stage may include encrypting the secure data, and the second stage may include encrypting the result of a logical operation on the encrypted secure data with a unique identifier of the portable electronic device. A secret key may be used as the encryption key for each stage. The result of the second encryption stage may include the generated key which may be used to perform subsequent operations on the portable electronic device.