On-Chip Root Key Decryption for Secure Network Software Updates
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The security of network devices is compromised when hackers intercept and decrypt device software packages using the root key plaintext, as the key can be stolen during transmission.
Innovation Solution
Integrate a hardware encryption and decryption component and a one-time programmable (OTP) storage area within a chip, protecting the root key plaintext from external access, allowing secure decryption of ciphertexts using the root key plaintext.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the root key plaintext is stored in a readable location for decryption operations, then the decryption function can be performed, but the security of the network device is compromised as hackers can intercept and use the key
Solution Approach 1:
The patent divides the key storage function into two separate components: a hardware encryption and decryption component that performs decryption operations and an OTP storage area that stores the root key plaintext. This segmentation ensures that the key is stored in a secure, non-readable location while still enabling decryption functionality through the protected hardware component.
Solution Approach 2:
The hardware encryption and decryption component acts as an intermediary between the OTP storage area (containing the root key plaintext) and the external application programs. This intermediary performs the decryption operation internally, preventing direct access to the key by external programs while still enabling the decryption function to operate.
2Reliability
If the root key plaintext is protected from external access, then security is improved, but the complexity of the device increases due to hardware integration requirements
Solution Approach 1:
The patent merges the hardware encryption and decryption component with the chip that contains the OTP storage area. By integrating these components into a single chip, the patent reduces overall device complexity compared to having separate external components, while still providing secure protection for the root key plaintext through the protected hardware architecture.
3Reliability
If the root key plaintext is stored in OTP memory, then unauthorized access is prevented, but the key cannot be modified or updated
Solution Approach 1:
The patent applies preliminary action by storing the root key plaintext in the OTP storage area during the manufacturing or initialization phase. The key is programmed into the OTP memory before the device is deployed, ensuring it is securely stored from the beginning. While the key cannot be modified after storage, the system maintains security through this preliminary programming approach.
Data Source
AI summary
In accordance with an embodiment, a network device includes a chip including a hardware encryption and decryption circuit and a one-time programmable (OTP) storage area; and a receiver configured to receive a to-be-decrypted file, where the to-be-decrypted file comprises a ciphertext. The hardware encryption and decryption circuit is configured to obtain a root key plaintext from the OTP storage area, and decrypt the ciphertext using the root key plaintext to obtain a plaintext.