Security Processor Key Protection Without Peripheral Overhead
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing key protection methods in computer systems compromise crypto operation performance due to peripheral access overhead and lack comprehensive security, especially for small data operations, and do not adequately manage the key life cycle.
Innovation Solution
Implement a security processor within the processor to manage application keys, using a root protection key module to encrypt and protect keys internally, ensuring only authorized access through a limited command interface, thereby preventing unauthorized access and export.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a peripheral crypto module is used to protect keys, then key security is improved, but peripheral access overhead increases and crypto operation performance deteriorates
Solution Approach 1:
The patent merges the key protection function with the processor by implementing a security processor as an internal module. The security processor is integrated into the processor architecture, allowing key protection operations to be performed without accessing external peripheral devices. This integration eliminates peripheral access overhead while maintaining secure key management capabilities.
Solution Approach 2:
The patent segments the processor into functional modules including a security processor for key protection and an application processor for crypto operations. This segmentation allows the security processor to handle key protection independently using hardware acceleration, while the application processor executes crypto operations, thereby improving overall system performance without compromising key security.
2Reliability
If comprehensive key protection measures are implemented, then key security is improved, but device complexity increases
Solution Approach 1:
The patent implements a nested key protection structure where a root protection key is used to protect multiple application keys. The security processor contains a key store that holds both the root protection key and application keys. This nested arrangement allows comprehensive key protection while maintaining a clear hierarchical structure that simplifies management and reduces system complexity.
3Reliability
If key protection processing is performed on exported keys, then key security is improved, but processing time increases
Solution Approach 1:
The patent performs key protection operations in advance using hardware acceleration capabilities. The security processor is pre-configured with protection mechanisms that can be applied to keys before they are exported or used. This preliminary action reduces the time required for subsequent key operations by avoiding repeated protection processing.
Data Source
Figure 1~2
Figure 3
Figure 4~5
AI summary
Embodiments of the present disclosure disclose a key protection method, a crypto operation method, a key protection apparatus, a crypto operation apparatus, a processor, a chip, and an electronic device. The key protection method is applied to a security processor disposed within a processor and includes: obtaining a key export request which is configured to request for exporting an application key and carries at least authorization information, wherein the security processor stores at least one application key; when the authorization information passes validation, invoking root protection key information and performing protection processing at least on an exported application key to generate a protected application key, wherein the root protection key information is stored in the processor; and exporting the protected application key.