Secret Storage Structure Using Hardware-Rooted Key Derivation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems face challenges in securely storing sensitive information due to limited hardware storage space and vulnerability to leaks when using software-based encryption, especially in multi-party manufacturing environments.
Innovation Solution
A secret storage structure is implemented with a hardware-based root key embedded in the system, from which wrap and authentication keys are derived to encrypt and authenticate secrets, providing secure storage while allowing easy sharing and increased accessibility.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If sensitive information is embedded into hardware (e.g., fuses), then security is improved, but storage space is limited and accessibility is reduced
Solution Approach 1:
The patent segments the storage system into two parts: a hardware component (secure element with root key) and a software component (secret storage structure). The hardware stores only the root key for key derivation, while the actual secrets are stored in software with encryption, thus resolving the contradiction between hardware security and software storage capacity.
Solution Approach 2:
The patent introduces cryptographic key derivation as an intermediary mechanism. The root key stored in hardware serves as an intermediary that derives multiple encryption keys (wrap key, authentication key) without exposing the root key itself, enabling secure software-based storage while maintaining hardware-rooted security.
2Reliability
If sensitive information is stored in hardware, then security is improved, but ease of sharing and accessibility deteriorates
Solution Approach 1:
The patent separates the security function (root key storage in hardware) from the data storage function (secrets in software). This segmentation allows the system to maintain hardware-level security while enabling software-level accessibility and sharing capabilities.
Solution Approach 2:
The patent enables the secret storage structure to be copied and shared across multiple systems while maintaining security through cryptographic authentication. The authenticated encryption allows verified copies to be distributed without compromising the root security mechanism.
3Quantity of substance
If software-based encryption is used, then storage capacity and accessibility are improved, but security and vulnerability to leaks worsen
Solution Approach 1:
The hardware-based root key acts as an intermediary that strengthens software-based encryption. Instead of relying solely on software key management, the system uses the root key to derive encryption keys, adding a hardware-rooted trust anchor to the software encryption layer.
Solution Approach 2:
The patent creates a composite security architecture combining hardware security elements (root key storage) with software encryption mechanisms (authenticated encryption). This hybrid approach leverages the strengths of both hardware and software to achieve secure, high-capacity storage.
Data Source
AI summary
Embodiments of the present disclosure relate to a method of encrypting a secret storage structure. The method may include storing a secret in a secret storage structure. The secret storage structure may be encrypted by encrypting the secret using a wrap key that is generated based at least on a hardware-based root key and a first context. The secret storage structure may additionally be encrypted by encrypting the secret storage structure using an authentication key that is generated based at least on the hardware-based root key and a second context.