Product Management System Authenticating Devices via HSM
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing product management systems struggle to verify the authenticity of product devices in supply chains, particularly due to issues like falsification of inspection data and replacement or impersonation of product devices, making it difficult to ensure the authenticity of products throughout the production, inspection, and distribution processes.
Innovation Solution
A product management system that includes an issuance mechanism for generating public key certificates with a unique identifier (UID) and secret key pair, an authentication mechanism for verifying the authenticity of these certificates using a hardware security module (HSM), and a data registration mechanism for associating product history data with the UID, ensuring the authenticity of the product device by verifying the signature and public key certificate.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If hash value is calculated and attached to shipment item, then item data integrity is improved, but vulnerability to replacement/impersonation attacks remains
Solution Approach 1:
The patent applies preliminary action by generating and embedding the secret key in the HSM of the product device before the device is shipped. This ensures that the authentication credentials are already in place and cannot be added later by impersonators. The public key certificate is issued and stored in the device prior to deployment, enabling immediate authentication capability.
Solution Approach 2:
The patent introduces a certificate authority (CA) as an intermediary that issues and verifies public key certificates. The CA acts as a trusted mediator between the product device and the authentication system, providing cryptographic verification through digital signatures. This intermediary layer enables reliable authentication without requiring direct trust between communicating parties.
2Reliability
If public key certificate and signature verification are implemented, then authentication security is improved, but system complexity increases
Solution Approach 1:
The patent applies self-service by enabling the product device to autonomously perform authentication using its embedded HSM and stored public key certificate. The device can independently verify its own identity and authenticate with the server without requiring manual intervention or complex external authentication infrastructure. The HSM automatically manages cryptographic operations.
Solution Approach 2:
The patent extracts the secret key management functionality into a dedicated hardware security module (HSM), separating it from the main device logic. This extraction allows the complex cryptographic operations to be handled by a specialized, secure component while the rest of the system remains relatively simple. The HSM handles key generation, storage, and cryptographic operations independently.
Data Source
AI summary
A product management system includes an issuance unit, an authentication unit, a data registration unit, and an output unit. When receiving a certificate issuance request from a product device, the issuance unit generates a public key certificate including a public key, an UID, and a signature of a certificate authority, and stores a secret key in an HSM. When receiving an authentication request from the product device, the authentication unit verifies the public key certificate, and verifies whether authentication data are signed with the secret key using the public key in the public key certificate. When receiving a use start request from the product device for which authentication has succeeded, the output unit reads, from a storage, product history data registered in association with the UID included in the public key certificate of the product device, and outputs output information regarding the product history data.