Secure Key Store Derivation from Single Root Key
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current multimedia devices lack secure storage solutions for user secrets and personally identifiable information, with security often being an afterthought due to their low cost nature, failing to protect users, content providers, and device manufacturers effectively.
Innovation Solution
A system that derives keys from a single secure root key, using ephemeral computations to create derived keys without storing raw key values, and encrypts these keys in a secure region of flash memory using advanced encryption standards like AES XEX or Liskov, Rivest, Wagner encryption modes, allowing for secure storage and communication while enabling factory reset or re-keying capabilities.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If expensive security methods are employed to protect user secrets and PII, then security reliability is improved, but device cost increases
Solution Approach 1:
The patent segments security keys into different hierarchical levels (root key, intermediate keys, application-specific keys) stored in different locations with different protection levels. This allows strong security for critical keys while using lighter protection for less critical data, reducing overall security implementation cost.
Solution Approach 2:
The patent introduces a key derivation function as an intermediary that transforms a single secure root key into multiple derived keys for different applications. This eliminates the need to store multiple separate secret keys, reducing storage requirements and simplifying key management while maintaining security.
2Reliability
If multiple keys are stored in device memory for different entities, then security coverage is improved, but storage requirements and key management complexity increase
Solution Approach 1:
The patent creates a universal root key that serves multiple functions by deriving different application-specific keys from it. This single root key can protect user secrets, content provider data, device manufacturer information, and more, eliminating the need for separate key management systems for each entity.
Solution Approach 2:
The patent uses cryptographic copying where a single root key is mathematically transformed into multiple derived keys through key derivation functions. These derived keys are stored in an encrypted key store, allowing secure access to multiple security domains without physically storing multiple master keys.
3Speed
If raw key values are stored in device storage for easy access, then key retrieval speed is improved, but security is compromised
Solution Approach 1:
The patent changes the state of key storage by storing keys in encrypted form rather than plaintext. The key store is encrypted using a random encryption code, and keys are derived computationally when needed rather than retrieved directly, maintaining both security and functionality.
Solution Approach 2:
The patent performs preliminary encryption of the key store using a random encryption code during device initialization. This preliminary security measure ensures that even if the storage is compromised, the raw key values remain protected, and keys can be derived on-demand without being pre-exposed in plaintext.
Data Source
AI summary
A root key of a computing device that is typically “burned” into the device hardware at time of manufacture is used to establish a master key and if desired a Transport Layer Security pre-shaped key, a WiFi configuration key, and application verification keys. The keys established from the root key are stored in a region of flash memory, and this region of flash memory is then encrypted using a random encryption code.