Secure OEM Identification via One-Way Hashing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing solutions for creating secure Original Equipment Manufacturer (OEM) identifiers are inflexible and complex, leading to inventory management issues and limited security offerings for hardware platform vendors, as they require programming of OEM-specific identifiers in a trusted environment, which exposes hardware-platform specific secrets and increases the risk of attacks.
Innovation Solution
Implementing a one-way hashing function in processing devices to generate OEM public IDs, which are programmed into one-time programmable memory, allowing derivation of OEM and device-specific keys for secure firmware operation without exposing hardware-platform secrets, thereby enhancing security and flexibility.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If OEM-specific identifiers are programmed into hardware platforms in a trusted environment, then security protection for OEM software assets is improved, but device complexity and inventory management complexity increase
Solution Approach 1:
The patent introduces a hardware platform vendor as an intermediary that generates public IDs and provides template code to OEMs. This intermediary approach allows OEMs to program their own devices without requiring access to a trusted environment or handling of hardware-platform secrets, thereby maintaining security while simplifying inventory management for hardware platform vendors.
Solution Approach 2:
The patent extracts the secret key generation and security-critical operations from the OEM environment and places them in the hardware platform vendor's controlled environment. Only the public ID, which is mathematically derived but cannot reveal the secret, is transferred to the OEM. This separation allows security to be maintained while reducing the complexity of inventory management for hardware platform vendors.
2Reliability
If hardware is programmed with OEM-specific identifiers in a trusted environment, then protection from clone manufacturers is improved, but loss of time and productivity decrease due to complex logistics
Solution Approach 1:
The patent enables OEMs to self-service by providing them with template code that allows their own systems to generate and program public IDs into hardware platforms. This eliminates the need for hardware platforms to be pre-programmed in a trusted environment, significantly improving inventory management efficiency and productivity while maintaining protection against clone manufacturers through cryptographic security.
3Reliability
If OEM-specific identifiers are programmed into hardware, then security verification capability is improved, but adaptability decreases as generic hardware becomes non-generic
Solution Approach 1:
The patent changes the parameter of identification from embedded hardware-specific identifiers to programmable public IDs that can be set by OEMs based on their needs. This allows the same generic hardware platform to be adapted to different OEMs without requiring pre-programming or modification of the hardware architecture, maintaining both security verification capability and hardware adaptability.
4Reliability
If secret keys are exposed in trusted environments for programming OEM identifiers, then authentication capability is improved, but security risk increases due to exposure of hardware-platform secrets
Solution Approach 1:
The patent converts the potential harm of secret key exposure into a benefit by using cryptographic one-way functions. The secret key is used to generate a public ID that provides authentication capability, but the public ID cannot be reverse-engineered to reveal the secret key. This transforms the secret key from a vulnerable asset into a secure foundation for authentication.
Solution Approach 2:
The patent uses the hardware platform vendor as an intermediary that handles secret key management and only transfers the derived public ID to OEMs. This intermediary approach ensures that hardware-platform secrets never leave the vendor's secure environment, eliminating the security risk of secret exposure while maintaining full authentication capability through the public ID.
Data Source
AI summary
Embodiments of the disclosure implement techniques to create secure Original Equipment Manufacturer (OEM) identifiers. In one embodiment, a processing system is disclosed. The processing system includes a memory to store an Original Equipment Manufacturer (OEM) key and a processing device, operatively coupled to the memory. The processing device is to receive the OEM key for an OEM system as input to a cryptographic hash function. A device key is produced by applying the cryptographic hash function to the OEM key and a global key associated with a vendor of the OEM system. The device key is provided to a security firmware device to authenticate the OEM system.