Secure Processor Immutable Memory Trust Anchor Data Installation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Manufacturing mobile devices in third-party facilities poses a security risk due to potential access by third-party operators to encrypted data, as they may not be trusted with decryption or encryption keys.
Innovation Solution
A device and method are provided with a secure processor that includes an immutable memory for trust anchor data and a module for non-exportable data, enabling the device to receive and decrypt encrypted keys without exposing the decryption keys to third parties, allowing secure installation of encrypted data packages without third-party access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If data is encrypted using third-party facilities for manufacturing and provisioning, then data security is improved, but third parties may still access the encrypted data
Solution Approach 1:
The patent segments the encryption system into multiple components: trust anchor data stored in immutable memory, manufacturing protection keys, and data encryption keys. This segmentation ensures that no single third party can access all components needed to decrypt the data, as the trust anchor data is isolated in secure immutable memory within the device itself.
Solution Approach 2:
The patent introduces trust anchor data as an intermediary element that mediates between the device and third-party manufacturers. This trust anchor data, stored in immutable memory, serves as a secure reference that enables verification without requiring third parties to access the actual encryption keys or decrypted data.
2Reliability
If decryption keys are stored securely in the device, then data protection is improved, but the device cannot be manufactured or updated by third parties
Solution Approach 1:
The patent implements preliminary action by pre-storing trust anchor data in immutable memory during device manufacturing, before the device is deployed. This pre-configured trust anchor enables subsequent secure operations including verification of manufacturing protection keys and validation of encrypted data packages, allowing third-party manufacturing while maintaining security.
Solution Approach 2:
The device performs self-verification operations using its own trust anchor data stored in immutable memory. The device can independently verify manufacturing protection keys and validate encrypted data packages without requiring external trusted parties, enabling secure third-party manufacturing while maintaining autonomous security verification.
3Reliability
If trust anchor data is stored in immutable memory, then security is improved, but the device complexity increases
Solution Approach 1:
The patent merges the trust anchor data storage function directly into the immutable memory component of the secure processor, rather than adding a separate dedicated hardware module. This integration approach maintains security while reducing overall device complexity by utilizing existing secure memory infrastructure for multiple purposes.
Data Source
AI summary
A device, system and method for installing encrypted data are provided. A device includes a processor comprising: immutable memory storing preconfigured trust anchor data; and a module storing preconfigured non-exportable data. The processor is configured to: receive an encrypted common protection key, encrypted using a manufacturing protection key, and an encrypted distribution private key, encrypted using a common protection key; obtain the manufacturing protection key using the preconfigured trust anchor data and the preconfigured non-exportable data; decrypt the encrypted common protection key using the manufacturing protection key to obtain the common protection key; decrypt the encrypted distribution private key using the common protection key to obtain a distribution private key; receive an encrypted data package including image-at-rest data encrypted with an image-at-rest key, the encrypted data package including encryption data for obtaining the image-at-rest key using the distribution private key; and install the encrypted data package at the memory.