On-the-Fly Cipher Key Management via Wrap and Protection Keys
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current encryption architectures face challenges in securely storing and managing keys in external memory, as they are vulnerable to theft, and existing methods do not effectively ensure the secure decryption of keys and important data within chip systems.
Innovation Solution
A method and device that utilize an on-the-fly cipher to request a wrap key from a cryptographic engine, which generates a key by combining a wrap key from internal memory and a protection key from external memory, enabling secure encryption and decryption processes through sideband communication between the external memory controller, cryptographic engine, and key store.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If keys are stored in external memory for easy access, then productivity is improved, but security deteriorates as keys become vulnerable to theft
Solution Approach 1:
The key management system is segmented into multiple components: key store for secure storage, cryptographic engine for key generation, and external memory controller for data access. This segmentation allows keys to be stored securely in external memory while maintaining fast access through dedicated hardware components.
Solution Approach 2:
A key store acts as an intermediary between the cryptographic engine and external memory. It securely manages wrap keys and protection keys, enabling fast key access without compromising security by preventing direct exposure of cryptographic keys to the external memory interface.
2Productivity
If encryption architecture uses AES CTR mode for on-the-fly decryption, then productivity is improved, but security deteriorates as keys stored in external memory remain vulnerable
Solution Approach 1:
The system performs preliminary key wrapping using a wrap key stored securely in the key store. Data in external memory is encrypted with this wrapped key, allowing fast decryption through AES CTR mode while maintaining security through the preliminary key protection mechanism.
Solution Approach 2:
The system changes the encryption parameter from storing plain keys to storing wrapped keys. The wrap key is derived from a master key through a key derivation function, transforming the key storage format to provide an additional security layer while maintaining compatibility with fast decryption algorithms.
3Reliability
If a cryptographic engine generates keys by combining wrap key and protection key, then security is improved, but device complexity increases
Solution Approach 1:
The key store serves multiple functions: storing wrap keys, storing protection keys, managing key derivation, and controlling key access. This multi-functionality reduces the need for separate dedicated components for each key management task, thereby reducing overall system complexity while maintaining security.
Data Source
AI summary
A method for protecting and managing keys is provided. The method includes the following steps. An OTF cipher transmits a request message to a cryptographic engine to request that the cryptographic engine obtain a wrap key when a key is located in an external memory. The cryptographic engine requests the wrap key from a key store. The key store reads and transmits the wrap key to the cryptographic engine. The OTF cipher requests access to a protection key from the key store, and the key store requests that an external memory controller read the protection key from the external memory. The external memory transmits the protection key to the cryptographic engine. The cryptographic engine generates the key according to the wrap key and the protection key and transmits the key to the OTF cipher. The OTF cipher uses the key to perform an encryption and decryption process.