Root of Trust Circuitry for Secure Real-Time Data Transfer
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing real-time data transfer systems face challenges in securing data integrity and preventing tampering, especially in applications where low-cost, low-power devices are used, as heavy cryptographic processing is not feasible and tampering may go undetected.
Innovation Solution
An apparatus and method that utilize a root of trust circuitry to generate a cryptographically verifiable integrity claim, combine it with data items, form a hash, and create a signature for secure transmission, employing protocols like JavaScript Web Token (JWT) to ensure data integrity and authenticity, while also using a nonce for replay attack protection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If heavy cryptographic processing is used to secure data transfer, then data integrity and security are improved, but device cost, power consumption, and processing load increase
Solution Approach 1:
The cryptographic protection is segmented into two parts: a one-time heavy operation (generating integrity claim and signature) performed by the data source, and lightweight verification operations performed by the data collector. This allows strong security at the source while keeping endpoint devices low-power and resource-constrained.
Solution Approach 2:
The integrity claim and cryptographic signature are generated in advance (before data transmission) and attached to the data bundle. This preliminary cryptographic processing ensures that subsequent verification at the receiver end requires minimal computation, resolving the contradiction between strong security and low power consumption.
2Reliability
If heavy cryptographic processing is used to secure data transfer, then data integrity and security are improved, but device complexity increases
Solution Approach 1:
The system segments cryptographic functionality into a sophisticated data source that can handle heavy processing, and simple data collectors that only need verification capabilities. This segmentation allows strong overall security while keeping individual endpoint devices simple and low-cost.
Solution Approach 2:
The integrity claim and signature act as cryptographic intermediaries that carry security information from the data source to the collector. These intermediaries enable the collector to verify data integrity without needing complex cryptographic processing capabilities.
3Speed
If real-time data transfer is implemented without cryptographic protection, then transmission speed and latency are improved, but vulnerability to tampering increases
Solution Approach 1:
Cryptographic protection is applied in advance by bundling the integrity claim and signature with the data before transmission. This allows the data to be transmitted in real-time without ongoing cryptographic processing, maintaining speed while ensuring tamper-detection capability through the pre-attached security credentials.
4Ease of operation
If data is transmitted without integrity verification, then processing simplicity is improved, but undetectable tampering becomes possible
Solution Approach 1:
The data bundle is made self- verifying by including the integrity claim and signature within the transmitted data itself. The data collector can independently verify authenticity without needing external verification infrastructure, maintaining processing simplicity while ensuring data correctness through self-contained cryptographic proof.
Data Source
AI summary
Real-time data transfer from a device is secured by: receiving data items from a data source, buffering and continually sending same to a data collector; generating by a root of trust a cryptographically verifiable integrity claim based on current hardware and software configuration of the apparatus; forming second data by combining at least the cryptographically verifiable integrity claim and an amount of the data items; forming a hash from at least the second data; obtaining a stamp; causing the root of trust circuitry to form a first signature from at least the hash; forming third data by combining at least the second data, the hash and the first signature; and providing the data collector with a secured transmission comprising the third data.