Secure Key Replacement With Signed Commands for Key Loss
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems fail to effectively replace public keys in devices when the corresponding private key becomes unavailable, rendering the devices useless and disrupting the ability of a signing server to provide signatures.
Innovation Solution
A secure key replacement system and method that generates a new key pair, distributes replacement commands signed by the active signing server, and authenticates these commands at the device level to replace the old public key with a new one, ensuring continuity of signature generation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the public key is stored securely in devices to authenticate signatures, then authentication reliability is improved, but the system becomes vulnerable to key replacement attacks and cannot adapt when the private key is lost or corrupted
Solution Approach 1:
The system pre-generates replacement public keys and stores them in devices alongside the original public key before any key loss occurs. When the private key becomes unavailable, the pre-stored replacement public key can be immediately activated without requiring device re-provisioning, thus maintaining both authentication reliability and adaptability to key loss scenarios
Solution Approach 2:
The system changes the state of the public key from static to dynamic by allowing multiple public keys to be stored and activated sequentially. The device can switch between the original public key and replacement public keys based on the availability of corresponding private keys, enabling adaptation while maintaining secure authentication
2Reliability
If backup copies of the private key are stored in secure locations, then availability is improved, but security is compromised due to the risk of unauthorized access to backup keys
Solution Approach 1:
The system extracts the backup key storage function from the private key itself and implements it at the device level using public key copies. Instead of backing up the private key (which would create security risks), the system stores replacement public keys in devices, which are inherently safer since they cannot be used to derive the private key or forge signatures without the corresponding private key
Solution Approach 2:
The system introduces replacement public keys as an intermediary mechanism between the original key pair and the backup recovery process. These intermediaries enable key replacement functionality without requiring direct access to or storage of backup private keys, thus eliminating the security vulnerability while maintaining availability
3Device complexity
If devices store only the original public key for authentication, then device simplicity is maintained, but the system fails when the corresponding private key is lost or corrupted
Solution Approach 1:
The system performs preliminary action by pre-loading replacement public keys into devices during manufacturing or initial provisioning, before any key loss scenario occurs. This allows devices to maintain simple storage structures while having backup authentication capabilities ready, resolving the contradiction between simplicity and reliability
Solution Approach 2:
The system provides beforehand cushioning by storing multiple public keys in devices as a protective measure against future private key loss. This cushioning layer ensures that even if the original private key becomes unavailable, the system can continue functioning using replacement key pairs, thus maintaining reliability without significantly increasing device complexity
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A system (10) includes an active signing server (14) including a secure storage and processing unit (16) and an interface (26). The secure storage and processing unit (16) is configured to store a first private key (30), generate signatures (38) using the first private key (30) for authentication by devices storing a first public key (32) forming a key pair with the first private key (30) and sign a replacement command using the first private key (30), the replacement command being configured to be used to instruct the devices (20) to replace the first public key (32) with a second public key (32) forming a key pair with a second private key (30). The interface is configured to provide the signatures to the devices (20) and the replacement command to at least one entity, which is remote to the active signing server (14) and the devices (20) for storage.