Authentication Using Public Key Hashes and Session Keys
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing authentication systems face challenges in cost-effectively managing and revoking public keys in devices like field programmable gate arrays (FPGAs), where flash memory integration is technically challenging and e-fuses occupy excessive space for storing public keys.
Innovation Solution
A method and system for authenticating data using a processor and non-volatile storage that stores combinations of public key representations and session key IDs, allowing for secure key management by determining payload authenticity based on accompanying keys and signatures, and enabling key revocation by disabling processing if the payload is not authentic.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If flash memory is used to store public keys, then non-volatile storage and reprogrammability are achieved, but integration into SRAM-based devices becomes technically challenging and costly
Solution Approach 1:
The patent uses e-fuses to store representations (hashes) of public keys rather than the actual public keys. This copying approach allows the system to achieve non-volatile storage of authentication data using e-fuse technology that is compatible with SRAM-based FPGAs, avoiding the integration challenges of flash memory while maintaining authentication reliability
Solution Approach 2:
The patent changes the parameter of storage medium from flash memory to e-fuses, which are native to SRAM-based FPGA technology. This parameter change resolves the manufacturing integration issue while maintaining the non-volatile storage capability needed for public key representation storage
2Ease of manufacture
If e-fuses are used to store public keys, then compatibility with SRAM-based devices is achieved, but storage area becomes excessively large relative to the information stored
Solution Approach 1:
The patent stores only representations (hashes) of public keys in e-fuses rather than the full public keys. This dramatically reduces the storage area required while maintaining the authentication functionality, as the hash representations are much smaller than the actual public key data
Solution Approach 2:
The patent extracts only the essential authentication information (hash representations of public keys and session key IDs) and stores them in e-fuses, leaving the full public key data to be provided externally when needed. This extraction approach minimizes the area occupied by non-volatile storage while preserving authentication capability
3Reliability
If public keys are stored in non-volatile memory for authentication, then authentication capability is achieved, but key revocation becomes complex and less flexible
Solution Approach 1:
The patent segments the authentication key system into multiple independent session keys, each with its own identifier stored in e-fuses. This segmentation allows individual session keys to be revoked independently without affecting other keys, simplifying key management and revocation processes while maintaining authentication capability
Solution Approach 2:
The patent implements dynamic key management by allowing session keys to be activated, deactivated, and revoked independently through e-fuse configurations. This dynamic approach enables flexible key revocation where specific session keys can be invalidated without reconfiguring the entire authentication system, reducing management complexity
Data Source
Figure 1
Figure 2
Figure 3~5
AI summary
One approach for authenticating data includes storing (302, 304) a plurality of combinations of representations of public keys and session key IDs in a non- volatile memory. A payload and accompanying public key, session key ID, and signature of the payload are input (402). The signature is a function (1 18) of the payload and a private key of a key pair that includes the accompanying public key and the private key. Authenticity of the payload is determined (406, 410, 418, 420) based on the accompanying public key and session key ID and the combinations stored in the non-volatile memory, and from the signature and the payload. In response to determining that the payload is authentic, the payload is processed (424), and in response to determining that the payload is not authentic, processing of the payload is disabled (422).