Secure Session Key Derivation Using Seed Values
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing key-based security systems for content access, such as smart cards and set-top boxes, are vulnerable to hacker compromises, leading to inconvenient re-keying processes and potential security breaches.
Innovation Solution
A security system that stores an initial device-unique secret key in a one-time programmable memory, allowing derivation of additional keys using a seed value, enabling the generation of new keys upon compromise, which can be used for secure communications without replacing the security device.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If key-based security mechanisms are used in portable security modules, then security protection is provided, but the system becomes vulnerable to hacker compromises requiring inconvenient re-keying processes
Solution Approach 1:
The system changes the parameter of key derivation by introducing a seed value that can be updated without replacing the security module. The secret key stored in OTP memory remains constant, but the derived keys change based on updated seed values, allowing remote key rotation when compromises are detected.
Solution Approach 2:
The security system segments the key management into two parts: a permanent secret key stored in secure OTP memory and a changeable seed value stored in reconfigurable memory. This segmentation allows the seed value to be updated independently to generate new derived keys without affecting the permanent secret key or requiring module replacement.
2Reliability
If derived keys are compromised, then security is lost, but physical replacement of security modules causes user disruption
Solution Approach 1:
The system performs preliminary action by pre-storing a permanent secret key in secure OTP memory that serves as the basis for deriving multiple different keys through seed values. This preliminary setup enables rapid key rotation when compromises occur, avoiding the need for physical module replacement and minimizing user disruption time.
3Reliability
If new keys are derived using a new seed value, then security is enhanced, but additional key management complexity is introduced
Solution Approach 1:
The system introduces a key derivation function as an intermediary that takes the permanent secret key and variable seed values to produce derived keys. This intermediary mechanism simplifies key management by automatically generating secure derived keys without requiring manual intervention or complex key distribution protocols, despite the enhanced security requirements.
Data Source
AI summary
A security system is disclosed in which a secure communication session is established between an external security processor and an interface device. After insertion of the external security processor into the interface device, an authorization server provides authorization to the external security processor and the interface device based on, for example, identification information for each device. A derived key may be generated using a common device security key, and a seed value stored at the interface device. The derived key may then be used for multiple communication sessions between the interface device and the external security processor.