Secure Subsystem Encryption Key Generation with Authentication Codes
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional systems fail to effectively store, access, or manage sensitive data with sufficiently secure encryption in embedded and portable electronic systems across broad use cases, exposing them to increasing security risks.
Innovation Solution
A method for generating a secure application key through a secure subsystem using authentication codes and hardware root keys, ensuring secure encryption key management by integrating a secure processor to authenticate and generate keys based on authentication criteria.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional encryption methods are used in embedded and portable electronic systems, then the systems can store and manage sensitive data, but the security protection is insufficient and systems are exposed to security risks
Solution Approach 1:
The system divides encryption key management into two separate components: a secure subsystem that generates and protects master encryption keys, and a system processor that handles application-level operations. This segmentation isolates the most sensitive key generation functions in a dedicated secure environment, improving overall security while maintaining manageable complexity through clear separation of duties.
Solution Approach 2:
A secure subsystem acts as an intermediary between the system processor and sensitive data storage. This intermediary generates authentication codes and encryption keys, then provides them to the system processor for data protection operations. The intermediary architecture ensures that sensitive key material never resides in the main system processor, enhancing security while keeping the system processor relatively simple.
2Adaptability or versatility
If open and flexible application operation is supported, then the systems can handle a wide variety of use cases, but security risks increase due to exposure to more attack vectors
Solution Approach 1:
The patent implements local quality by providing different security levels to different parts of the system. The secure subsystem maintains high-security key generation and protection, while the system processor handles flexible application operations with lower security requirements. This localized security approach allows open and flexible application operation in the system processor while maintaining strong security in the dedicated secure subsystem, effectively managing security risks across diverse use cases.
3Reliability
If authentication and key generation are performed in a secure subsystem, then encryption key management security is enhanced, but the device complexity increases
Solution Approach 1:
The patent merges the secure subsystem and system processor into a single integrated device with shared memory and communication interfaces. This merging approach allows authentication and key generation functions to be enhanced in the secure subsystem while avoiding the complexity of completely separate systems. The integrated architecture enables secure key management operations without requiring entirely separate hardware components, thus enhancing security while controlling overall device complexity.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Example implementations include a method of generating a first authentication code based at least partially on an authentication key and an application key, transmitting to a secure subsystem of the local processing device the authentication key, the application key, and the first authentication code, generating, at the secure subsystem, a second authentication code based at least partially on the authentication key and the application key, and generating, at the secure subsystem, a secure application key, in accordance with a determination that the first authentication code and the second authentication code satisfy an authentication criterion.