Secure Key Storage Architecture for Processor Security Modules
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing electronic devices face vulnerabilities in securing authentication keys and sensitive information due to potential unauthorized access and manipulation by malicious attackers, necessitating enhanced security measures.
Innovation Solution
Incorporating a security module and processor system that generates and manages authentication and session keys using unique identifiers and algorithms, ensuring secure storage and communication within a secure execution environment, isolating normal and secure worlds within the processor to prevent unauthorized access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If authentication keys and security information are stored in the electronic device, then security functionality is provided, but vulnerability to unauthorized access and manipulation by malicious attackers increases
Solution Approach 1:
The patent divides the security system into two independent parts: a processor that generates security keys and a separate security module that stores them. This segmentation ensures that even if the processor is compromised, the stored authentication keys remain protected in the isolated security module, thereby maintaining security functionality while reducing vulnerability to unauthorized access.
Solution Approach 2:
The patent introduces a dedicated security module as an intermediary component between the processor and the stored security information. This intermediary provides an additional layer of protection by isolating the storage of authentication keys from the main processing unit, preventing direct manipulation while allowing controlled access for authentication purposes.
2Reliability
If a security module separate from the processor is used, then security is strengthened, but device complexity increases
Solution Approach 1:
The patent combines the security module and processor into a single integrated electronic device, allowing them to communicate through internal interfaces. This merging approach strengthens security through physical integration while managing complexity by establishing clear communication protocols between the two components, avoiding the need for separate external security devices.
3Reliability
If multiple keys (authentication key and session key) are generated and stored, then security is enhanced, but storage requirements and processing overhead increase
Solution Approach 1:
The patent generates and stores the authentication key in advance during device initialization or first boot, before any session-specific operations occur. This preliminary action allows the authentication key to be prepared and securely stored in the security module beforehand, reducing the need for repeated key generation and lowering overall processing overhead during subsequent authentication operations.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
An electronic device is disclosed. An electronic device according to an embodiment of the present disclosure may comprise: a security module for storing security information of the electronic device and performing an operation related to security; and a processor connected to the security module, wherein the processor is configured to generate, in response to identifying a request to store an authentication key, an authentication key on the basis of an identifier of a main integrated circuit (IC) on which the processor is disposed and a first security algorithm, and transmit the generated authentication key to the security module, and wherein the security module is configured to store the authentication key in the security module when there is no authentication key stored in the security module.