Secure Element Client-Server Sync Through an Encrypted Host Path
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Synchronizing application-related data across multiple secure elements in a secure and simple manner is challenging, particularly in vehicle access systems where timing requirements are stringent.
Innovation Solution
A data processing system with a client-server relationship between secure elements, using a cryptographic key shared only between them, enables secure and efficient synchronization of data through a host processor, with features like mutual authentication and secure binding processes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If data is synchronized across multiple secure elements through a host processor, then data consistency is improved, but security is worsened due to potential eavesdropping and manipulation
Solution Approach 1:
The host processor serves as an intermediary that facilitates secure key distribution and encrypted data transmission between secure elements. The host processor triggers key sharing and coordinates synchronized data transmission, enabling secure communication without direct peer-to-peer connections that would be vulnerable to attacks.
Solution Approach 2:
The system transforms data from plaintext to encrypted form using cryptographic keys, changing the parameter of data security. Synchronized data is encrypted before transmission through the host processor, ensuring that even if intercepted, the data remains protected. The encryption parameter dynamically changes based on shared cryptographic keys between secure elements.
2Reliability
If cryptographic key sharing is implemented between secure elements, then security is improved, but device complexity is worsened
Solution Approach 1:
The host processor acts as a mediator that simplifies key management complexity. Instead of implementing complex key management protocols within each secure element, the host processor centrally coordinates key sharing, triggering and managing the distribution of cryptographic keys between secure elements, thereby reducing individual device complexity.
Solution Approach 2:
The secure elements perform mutual authentication autonomously using pre-shared secrets, without requiring complex external verification systems. Each secure element independently verifies the other's identity, simplifying the overall authentication architecture while maintaining high security standards.
3Reliability
If mutual authentication is performed before data transmission, then security is improved, but time consumption is worsened
Solution Approach 1:
Mutual authentication is performed as a preliminary action before data transmission begins. Secure elements exchange authentication credentials and verify each other's identities in advance, establishing secure communication channels before actual synchronized data is transmitted, ensuring security without delaying the main data synchronization task.
Solution Approach 2:
The system uses pre-shared cryptographic keys that are copied and stored in each secure element during manufacturing or initial provisioning. These copied keys enable rapid mutual authentication without requiring real-time key generation or complex verification protocols, reducing authentication time while maintaining security.
Data Source
Figure 1~2
Figure 3
Figure 4
AI summary
In accordance with a first aspect of the present disclosure, a data processing system is provided, comprising: a first host processor; a first secure element operatively coupled to the first host processor; a second secure element operatively coupled to the first host processor; wherein the first secure element is configured to function as a server and the second secure element is configured to function as a client in a client-server relationship between the first secure element and the second secure element; wherein the first secure element is configured to transmit synchronization data to the second secure element through the first host processor, wherein said synchronization data have been encrypted using a cryptographic key shared only between the first secure element and the second secure element.