Secure Sensor Key Sharing via Symmetric Cryptography
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Computing platforms face challenges in securing input data from sensors due to limited compute capabilities and the risk of security mechanisms being compromised during manufacturing, especially when multiple entities are involved in device production, making effective secure key sharing between sensors and computing platforms difficult.
Innovation Solution
A communication system that provisions computing platforms and sensors to enable secure key sharing using symmetric key cryptography without relying on expensive public key cryptography or trusting third parties, by generating and encrypting public and private keys, and symmetric keys, which are then embedded in firmware, allowing secure communication even over untrusted channels.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If public key cryptography is used for secure key sharing, then security is improved, but cost and computational complexity increase
Solution Approach 1:
The patent uses symmetric keys that are ephemeral and disposed of after a single use for key establishment. The symmetric keys are generated, used to establish secure communication, and then discarded, replacing the need for expensive public key infrastructure. This applies the principle of using cheap, disposable cryptographic materials instead of expensive, long-lived cryptographic structures.
Solution Approach 2:
The patent changes the cryptographic parameters by switching from asymmetric key cryptography (public key) to symmetric key cryptography. This parameter change reduces computational complexity and cost while maintaining security through a different cryptographic approach that leverages the shared secret established during provisioning.
2Ease of manufacture
If multiple entities are involved in device manufacturing, then production flexibility is improved, but security risk increases
Solution Approach 1:
The patent performs preliminary cryptographic provisioning during manufacturing when the sensor and computing platform are still under controlled conditions. The symmetric keys are established and embedded in firmware before the devices are distributed to multiple manufacturing entities. This preliminary action ensures security is established once under trusted conditions, and then maintained through that established channel regardless of how many entities subsequently handle the devices.
Solution Approach 2:
The patent introduces symmetric keys as an intermediary that mediates secure communication between the sensor and computing platform. These keys act as a trusted intermediary that was established during provisioning, allowing secure communication without requiring continuous trust verification through multiple manufacturing entities. The symmetric key serves as the intermediary that bridges the trust gap created by multiple manufacturing parties.
3Reliability
If sensor compute capabilities are increased to implement stronger security mechanisms, then security is improved, but sensor cost and power consumption increase
Solution Approach 1:
The patent performs computationally intensive cryptographic operations during the provisioning phase, which occurs during manufacturing when the sensor is not yet deployed. The symmetric keys are generated and embedded in firmware through preliminary actions taken during production. Once deployed, the sensor only needs to perform lightweight symmetric encryption and decryption operations, avoiding the need for high compute capabilities during actual operation.
Data Source
AI summary
Technologies disclosed herein provide an apparatus comprising a sensor including a first processor configured to execute first instructions to identify, based on an index, a first encrypted key of a first set of encrypted keys, identify, based on the index, a second encrypted key of a second set of encrypted keys, and extract a first trusted symmetric key from the first encrypted key using a first decryption algorithm and a first decryption key. The apparatus further comprises a computing platform coupled to the sensor and including a memory element and a processor configured to execute second instructions stored in the memory element to receive the second encrypted key from the sensor and extract a second trusted symmetric key from the second encrypted key using a second decryption algorithm and a second decryption key, where the first trusted symmetric key matches the second trusted symmetric key.