Secure Element Authentication for Device-Server Communication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for securing communication between devices equipped with secure elements and remote servers require pre- or post-association, pairing, or dynamic linking of supply chains, which complicates manufacturing and increases security risks.
Innovation Solution
A method for securing communication between a device and a remote server using asymmetric cryptography, where device and server key materials are generated independently based on device and server profile and secure element data, with only public data exchanged during association, ensuring secure authentication without requiring high-security communication links.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If pre-association or post-association methods are used to secure device profiles, then security against profile copying and disclosure is improved, but manufacturing complexity and supply chain coordination requirements increase
Solution Approach 1:
The patent applies preliminary action by pre-generating secure element data and device profile data independently at their respective manufacturing locations before the devices are assembled. The secure element data is generated at the secure element manufacturing location and stored in image data, while device profile data is generated at the device manufacturing location. This allows both datasets to be prepared in advance without requiring complex coordination during the assembly process, resolving the contradiction between security and manufacturing complexity.
2Reliability
If dynamic association between secure element and device is implemented, then security against emulation and cloning is improved, but supply chain coordination and interaction requirements increase
Solution Approach 1:
The patent applies self-service by enabling each manufacturing location to independently generate and prepare their respective data without requiring interaction with the other supply chain. The secure element manufacturing location generates secure element data and stores it in image data, while the device manufacturing location generates device profile data. During device assembly, the system automatically retrieves the pre-prepared secure element data from image data using the secure element identifier, eliminating the need for complex dynamic coordination between supply chains.
3Reliability
If secure element data is pre-encrypted with all possible RoT secrets, then security against unauthorized access is improved, but storage requirements and processing overhead increase
Solution Approach 1:
The patent applies local quality by storing secure element data in an unencrypted format in image data, but only encrypting specific sensitive information (such as the secure element identifier) when retrieving and using it during device assembly. This approach maintains security for the actual secure element data while avoiding the overhead of pre-encrypting all possible data, thus resolving the contradiction between security and data storage requirements.
Data Source
AI summary
Method for securing a communication between a remote server and a device equipped with a secure element,device side profile data being stored in the device,device side secure element data being stored in the secure element,image data comprising:server side profile data being stored in the remote server,server side secure element data being stored in the remote server, or being retrievable from the remote server,the method comprising the steps of:a—associating the device with the secure element,b—generating, on the device side, a device key material,c—reporting the association to the remote server,d—generating, on the remote server side, a server key materiale—authorizing a communication between the device and the remote server, after an authentication based at least on the basis of a comparison between the device key material and the server key material.