Security Module Determining Device-Specific Private Keys
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cryptographic systems face challenges in generating and managing multiple private keys for different asymmetrical cryptographic methods without the need for separate key storage, especially in devices without non-volatile memory.
Innovation Solution
A method and security module that reproducibly form a device-specific private starting value from secret data, using physically unclonable functions or symmetrical key derivation, to derive a device-specific private key for asymmetrical cryptographic methods, eliminating the need for internal key storage and ensuring secure, hardware-specific key generation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If a device stores multiple private keys for different asymmetrical cryptographic methods, then the device can support different cryptographic methods, but the device requires non-volatile memory for key storage
Solution Approach 1:
The patent extracts the private key generation process from external key storage and implements it within the cryptographic module itself. The private key is generated deterministically from a seed value that is processed through a key derivation function, eliminating the need to store the private key externally while still enabling support for multiple cryptographic methods.
Solution Approach 2:
The cryptographic module performs self-service by generating its own private keys deterministically from a seed value using a key derivation function. This self-contained approach allows the module to support multiple cryptographic methods without requiring external non-volatile memory for key storage, as the key generation is performed autonomously within the module.
2Device complexity
If a device generates private keys without non-volatile memory, then the device structure is simplified, but the key generation security may be compromised
Solution Approach 1:
The patent segments the cryptographic system into distinct functional components: a secure seed value storage, a key derivation function, and private key generation. This segmentation allows the system to maintain security through the protected seed value while keeping the overall device structure simple by eliminating the need for separate private key storage.
Solution Approach 2:
The patent introduces a key derivation function as an intermediary between the seed value and the private key. This intermediary process transforms the protected seed value into the private key through a deterministic algorithm, maintaining security while avoiding the need to store the private key itself, thus simplifying the device structure.
3Adaptability or versatility
If a device uses a primary platform starting value for key derivation, then the device can support different cryptographic methods, but the device is restricted to deriving a private key for a particular asymmetrical method
Solution Approach 1:
The patent implements a universal key derivation function that can generate private keys for multiple asymmetrical cryptographic methods from a single seed value. This multi-functional approach allows the same cryptographic module to support different cryptographic methods (such as RSA, ECDSA, EdDSA) without requiring separate key storage for each method, thereby achieving adaptability without increasing device complexity.
Data Source
AI summary
Provided is a method and a security module for determining or providing a device-specific private key for an asymmetrical cryptographic process. A device-specific private primary seed is reproducibly formed from a device-specific secret piece of data, and the device-specific private key is determined from the device-specific private primary seed.