Secure Master Key Provisioning in Semiconductor Devices
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for provisioning secure information into semiconductor devices face challenges in ensuring secure and efficient transfer of master keys, often leading to exposure and leakage, particularly when interfaces for provisioning are easy to use but difficult to secure.
Innovation Solution
A semiconductor device and method that includes a device key storage, a master key generator, and a cryptographic engine, which uses a physically unclonable function (PUF) key to encrypt and decrypt the master key, ensuring secure provisioning and protection from external access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If a simple interface is used for provisioning secure information, then ease of operation is improved, but security is worsened due to exposure and leakage risks
Solution Approach 1:
The patent introduces an encrypted master key as an intermediary between the provisioning interface and the actual secure information. The master key is encrypted using a public key or public key pair before being provisioned through the interface, while the corresponding private key remains securely stored in the semiconductor device. This intermediary structure allows easy provisioning of encrypted data while maintaining security through the private key that can only decrypt the master key within the secure device boundaries.
2Reliability
If secure access control is implemented for provisioning interfaces, then security is improved, but ease of operation is worsened due to complex access procedures
Solution Approach 1:
The patent implements preliminary action by pre-configuring the semiconductor device with a public key or public key pair during manufacturing. This preliminary setup eliminates the need for complex access control procedures during provisioning, as anyone can encrypt the master key using the publicly available public key. The security is already established in advance through the asymmetric key pair configuration, allowing simple provisioning operations without compromising security.
3Ease of operation
If the master key is stored in plaintext for easy access, then ease of operation is improved, but security is worsened due to exposure and leakage
Solution Approach 1:
The patent uses an encrypted master key as an intermediary layer between the storage medium and the cryptographic operations. Instead of storing the plaintext master key, the system stores the encrypted version which cannot be accessed or leaked. The decryption process occurs only within the secure boundaries of the semiconductor device using the privately stored private key, ensuring that even if the encrypted master key is exposed, the actual master key remains protected.
4Reliability
If complex encryption mechanisms are used for master key protection, then security is improved, but device complexity is worsened
Solution Approach 1:
The patent extracts the complex asymmetric key pair management from the semiconductor device by implementing the public key infrastructure externally. The device only needs to store the private key and perform simple decryption operations using this private key, while the complex encryption and key management functions are handled by external systems. This extraction reduces the device complexity while maintaining strong security through the use of public key cryptography in the provisioning process.
Data Source
AI summary
A semiconductor device for provisioning secure information of a demander includes a device key storage configured to store a device key provisioned by a supplier of the semiconductor device, a master key generator configured to generate, based on the device key and demander data provisioned by the demander, a master key of the demander by using a first operation shared with the supplier and a second operation shared with the demander, and a cryptographic engine configured to perform a cryptographic operation based on the master key.