SoC Cryptographic Key Hierarchy for Constant-Time Key Derivation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Modern computer systems face security challenges due to scarce computing resources on system-on-chip (SoC), where security technologies consume valuable processing and memory capacity, impacting application performance, and existing cryptographic key generation methods risk exposure by storing keys in memory.
Innovation Solution
A cryptographic key hierarchy is used to generate keys as-needed and in constant time, utilizing a cryptographic key from a parent node to generate child nodes, with unique identifiers and variable iterations per level to enhance security and avoid pre-stored keys.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If cryptographic keys are stored in memory for quick access, then key retrieval speed is improved, but security is worsened due to potential exposure and memory attacks
Solution Approach 1:
The system performs preliminary key generation by creating a hierarchical structure of cryptographic keys during system initialization. Master keys and intermediate keys are generated in advance and stored in secure hardware elements, while actual data encryption keys are derived on-demand through cryptographic functions, combining pre-computation security benefits with runtime flexibility
Solution Approach 2:
The patent introduces intermediate keys as mediators between master keys and data encryption keys. These intermediate keys act as a buffer layer that prevents direct exposure of master keys while enabling efficient key derivation. The hierarchical structure with multiple intermediate layers reduces the computational burden on master keys while maintaining security
2Adaptability or versatility
If multiple cryptographic keys are pre-generated and stored, then key availability is improved, but memory usage increases consuming scarce SoC resources
Solution Approach 1:
The system implements self-service key generation where cryptographic keys are derived on-demand from stored master keys using cryptographic functions. Instead of pre-storing multiple keys, the system generates required keys by processing the master key through defined cryptographic operations, allowing unlimited key availability without proportional memory increases
Solution Approach 2:
The master key serves multiple functions by being used to derive different intermediate keys and ultimately various data encryption keys through the hierarchical structure. A single master key stored in secure memory can generate numerous operational keys, making the stored key multi-functional and reducing the total number of keys that need to be stored
3Reliability
If cryptographic processing is performed frequently to generate keys on-demand, then security is improved by avoiding stored keys, but processing overhead increases impacting application performance
Solution Approach 1:
The system performs preliminary cryptographic processing by pre-generating intermediate keys and deriving functions during system initialization. This pre-computation caches intermediate results that can be quickly combined with application-specific parameters to generate final encryption keys, reducing runtime processing overhead while maintaining security
Solution Approach 2:
The key generation process is segmented into hierarchical levels: master key generation, intermediate key derivation, and final encryption key creation. Each level can be independently optimized and cached. The segmentation allows the system to pre-compute upper levels securely while performing only lightweight operations at the final level during application execution
Data Source
AI summary
The technology described herein generates cryptographic keys for a system on-chip (SoC). The technology uses a cryptographic key hierarchy to generate cryptographic keys as needed and in constant time. The cryptographic key hierarchy uses a cryptographic key from a parent node as an input to the cryptographic function used to generate cryptographic keys associated with child nodes of the parent node. A single cryptographic key or batch of cryptographic keys may be generated as needed in response to a trigger event. Each key may be generated using a prescribed amount of iterations performed across the various hierarchical levels of the cryptographic key hierarchy. The amount of iterations performed at each level may be determined on a chip-by-chip basis. The unique identifier on a SoC may also be used as an input to the cryptographic function. Using the unique identifier as an input to the cryptographic function generates SoC-specific cryptographic keys.